Date: 10/19/2026
Severity: High
Summary
Three exposed directories on `45.142.193[.]132` disclosed attacker utilities, exploit code, activity logs, and post-compromise artifacts. The directory on port 18080 contained a PaperCut exploitation toolkit with AI-agent instructions, vulnerability analysis tools, exploit variants, and research documentation. The toolkit revealed an additional PaperCut RCE technique using XML-RPC methods `api.setConfigValue` and `api.lookUpUserNameByCardNo` under weak API access controls. Further operations involved Windows and service credential theft, internal network movement, automated Metasploit execution, and packaging of victim-related data.
Indicators of Compromise (IOC) List
IP Address | 45.142.193.132 45.158.196.75 |
Hash | 528cd4e69ecfa5191adbcf6ef28667bf
ce870a91e8d27e8f663f0687abc60b04
a6437ac3d6798090a218520985d36a3f
fc92dfafa7aa741c5f2b9cbcf75d1d19
|
Filepath | /var/tmp/.rs_live46_v5/ |
Endpoint | /rpc/api/xmlrpc |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | dstipaddress IN ("45.158.196.75","45.142.193.132") or srcipaddress IN ("45.158.196.75","45.142.193.132") |
Detection Query 2 : | md5hash IN ("fc92dfafa7aa741c5f2b9cbcf75d1d19","528cd4e69ecfa5191adbcf6ef28667bf","ce870a91e8d27e8f663f0687abc60b04","a6437ac3d6798090a218520985d36a3f")
|
Detection Query 3 : | datasourcename = "Windows Security" and eventtype = "4663" and objectname like "/var/tmp/.rs_live46_v5/" |
Detection Query 4 : | technologygroup = "EDR" and objectname like "/var/tmp/.rs_live46_v5/" |
Reference:
PaperCut Exploitation Infrastructure