A working proof-of-concept (PoC) exploit has been published for an actively exploited critical vulnerability affecting the PaperCut print management software. PaperCut is a powerful print management solution for enabling, tracking, managing, and securing an organization’s printing, copying, and scanning needs. The vulnerability, tracked as CVE-2023–27350, was given a CVSS score of 9.8/10 and is a remote code execution (RCE) flaw that allows unauthenticated attackers to execute malicious code on servers running vulnerable versions of PaperCut. Security researchers have reported that two (2) days after the active-exploitation started, threat actors were observed exploiting CVE-2023–27350 to install malicious remote management software from the internet. Once the threat actors had remote control of the targeted servers, researchers observed installation of a malware strain known as “TrueBot”. TrueBot is linked to the notorious Clop ransomware group and their affiliates and was recently deployed to exploit the GoAnywhere vulnerability. Researchers have also observed the exploitation of a related vulnerability, tracked as CVE-2023–27351. This is an authentication bypass vulnerability with a CVSS score of 8.2/10 that could allow unauthenticated attackers to exfiltrate sensitive data. A scan from the Shodan search engine revealed that there are approximately 1,700 PaperCut instances exposed to the public-facing internet, and researchers have reported that approximately 900 of them remain unpatched. The wide availability of vulnerable servers, coupled with the low complexity of the attack, make this flaw particularly troubling. CTIX analysts recommend that all organizations implementing PaperCut NG or MF install the most recent security patch to prevent being targeted by threat actors.