If you run PaperCut NG/MF, confirm you are on 26.0.5 / 25.0.13 / 24.1.11 or later, then hunt for GreyNoise's campaign artifacts even if you patched after Sept 1–2. Network: egress/ingress involving 45.142.193[.]132 and 45.158.196[.]75 (orchestration/execution hosts), especially :8000/:8089. Host: look for new local admin Administrator17; files C:\Windows\Temp\pc-sys.hiv, pc-sec.hiv, pc-security.hiv, pc-system.hiv, pc-*.b64; C:\ProgramData\pc-sys-reg.hiv; Ligolo at C:\ProgramData\ligolo-agent.exe or C:\ProgramData\LegitSvc\legit-svc.exe; PaperCut custom web markers ...\PaperCut MF\server\custom\web\pcp_<10rand>.txt. Process/cmdline: reg save HKLM\SYSTEM/SECURITY into those Temp paths followed by certutil -encode; downloads of lsa_collect / lsa_read / save_hives / collect_custom. Identity: unexpected Domain Admins adds and DCSync/NTDS.dit access shortly after PaperCut RCE. Education-sector PaperCut that was internet-facing in late August–early September should assume compromise until cleared.