PaperCut Evidence Preservation Comes Before Emergency Patch Release 2

PaperCut says every NG and MF version is affected, exploitation is active, fixes exist only for versions 25 and 26, and suspicious pc-app.exe activity plus deleted or truncated logs may indicate compromise. Take an exploit-feasibility position: what can we establish from the available evidence, what remains unknown, and what exact 30-minute sequence preserves evidence without leaving the service exposed? Distinguish patching from compromise assessment and challenge any unjustified assumptions in the source pack.

FACT: This is a closed exploit chain, not CVSS theater: authentication bypass plus unsafe dynamic class loading can produce pre-authentication RCE under the PaperCut server process. Researchers reproduced it, and the first emergency patch was bypassable. Use Emergency Patch Release 2. Current reporting lists patches for versions 24, 25, and 26, so “fixes exist only for 25 and 26” is stale. “All versions potentially vulnerable” also does not prove every build or deployment is exploitable.

UNKNOWN: Active exploitation does not establish compromise of your server. Suspicious pc-app.exe descendants and missing, truncated, or deleted server.log files are indicators—not verdicts. Their absence is not clearance either. Patching closes the known door; it does not remove persistence, restore deleted evidence, or determine whether data was accessed.

Exact first 30 minutes: - 0–2: Block all PaperCut-server ingress and egress at the firewall/reverse proxy. Do not reboot, stop services, clean files, or patch. - 2–5: Record time, sessions, listeners and connections. Capture memory only with a tested rapid-acquisition procedure. - 5–12: Export EDR alerts, pc-app.exe process trees, command lines, hashes, network connections and child processes. - 12–20: Preserve the complete PaperCut logs directory with timestamps/metadata, configuration, persistence artifacts, and relevant application files. - 20–25: Preserve reverse-proxy, WAF, firewall, DNS and flow logs before rotation; hash collected evidence. - 25–30: Fully isolate the host. Stage Release 2 offline—or preferably rebuild from known-good media if compromise indicators exist. Restore service only after credential rotation and scope assessment. James Okafor independently agreed with containment-before-patching: patching first is like replacing the lock before dusting for fingerprints.

Ten releases of @7nohe/openapi-react-query-codegen allegedly contained credential-stealing code, with a GitHub Actions weakness assessed as the possible entry path. Determine the realistic blast radius across repository, registry, cloud, and infrastructure credentials. Give a defensible scoping and rotation order for teams that may have executed the package, and separate confirmed package compromise from the still-hypothetical workflow root cause.

Confirmed: Ten npm versions were malicious: 0.5.4–0.5.5, 1.6.3–1.6.4, 2.2.1–2.2.2, 3.0.3–3.0.4, plus two 0.0.0-* bootstrap builds. Socket found installation-time execution through binding.gyp; later variants also used preinstall. Treat any host or CI runner that installed these versions with scripts enabled as potentially executed—not merely exposed.

Blast-radius assessment: - Repository credentials — high: GitHub tokens, PATs, deploy keys, or persisted checkout credentials accessible to the process could expose additional repositories. - Registry credentials — critical: Endor reports cross-registry replication involving npm, RubyGems, and PyPI. Inspect every namespace the affected identity could publish to, not only this package. - Cloud credentials — critical when installation occurred on CI/cloud hosts: The malware harvested cloud credentials; bound scope depends on environment variables, local credential files, and runner identity available during execution. - Infrastructure credentials — conditional: Assume kubeconfigs, SSH keys, Vault/Terraform tokens, container-registry credentials, and signing material are exposed only where they were accessible to that host or runner. Their theft is not established for every victim.

Rotation order should follow privilege and propagation potential: (1) isolate affected systems and disable the vulnerable workflow; revoke GitHub sessions, PATs, GitHub App tokens, deploy keys, and CI OIDC/trusted-publishing relationships; (2) revoke npm, PyPI, RubyGems, and container-registry credentials and audit unauthorized releases; (3) revoke cloud access keys and active sessions, then review assumed-role activity; (4) rotate infrastructure and signing credentials reachable from those systems; (5) rotate lower-impact application secrets. Perform rotation from a clean machine and rebuild runners rather than trusting cleanup in place.

The workflow is a compelling entry-path hypothesis: Socket describes an unauthenticated issue_comment release path that checked out fork-controlled code, ran pnpm install, and obtained npm publishing authority through id-token: write; StepSecurity characterizes it as exploited. But public excerpts do not provide the GitHub audit logs or complete run evidence needed to prove that causal chain conclusively. The malicious registry artifacts are confirmed; maintainer-account compromise, source-repository mutation, and the exact workflow run that produced them remain unproven here.

Compare the decision urgency of the Cosmos EVM exploitation across six chains with Ajna v2's unpatchable liquidation flaw, then place Rain and The Sandbox behind them if the evidence supports that ranking. Quantify confirmed losses separately from unauthorized minting, identify who remains exposed now, and give one immediate containment decision per incident without treating all four as the same smart-contract failure.

Halil, my urgency ranking is 1) Cosmos EVM, 2) Ajna v2, 3) Rain, 4) The Sandbox—provisionally.

• Cosmos EVM: FACT: exploitation affected six chains. Reported movements include 2.986 billion TAC valued near $7.5 million, 148.3 million KII, and roughly $50 million face value of minted NES bridged to Ethereum. Because liquidity and slippage reportedly limited the NES attacker’s proceeds to about $60,000, that $50 million must not be counted as confirmed loss. Decision: halt every chain using the affected component, patch it, and reconcile supply and bridge state before restart.
• Ajna v2: FACT: seven pools lost approximately $775,400. Its immutable contracts cannot be conventionally patched. Decision: block new deposits and direct lenders and borrowers to exit or unwind exposed positions immediately.
• Rain: FACT: the obsolete card contract reportedly lost $1.1 million. Decision: retire and isolate that contract, migrate remaining users, then reconcile and refund affected balances.
• The Sandbox: UNKNOWN: the available evidence does not quantify a loss or establish current asset exposure. That makes fourth place defensible but low-confidence. If privileged authority was abused as described, the immediate decision is to revoke or rotate that authority and suspend affected administrative functions.

The key accounting distinction is therefore: confirmed or monetized impact includes approximately $7.5 million TAC, about $60,000 estimated NES proceeds, 148.3 million KII with no reliable USD valuation provided, $775,400 Ajna, and $1.1 million Rain. Unauthorized creation or face value includes the separate approximately $50 million NES mint, which should not be added to realized losses. Cosmos is a shared-chain software and state-integrity emergency; Ajna is an immutable liquidation-design failure; Rain is obsolete-contract exposure; The Sandbox is presented as privileged-authority abuse.

We already discussed QTFY attribution earlier today. Focus only on the operational delta: three required QScan/QTRouter domains were seized after infrastructure allegedly enabled two million daily scans using roughly 200 exploits and data theft from more than 300 organizations. How much disruption can we infer, what would indicate reconstitution, and which victim-side evidence would justify escalating from exposure review to incident response? Do not equate Chinese-language or China-linked infrastructure with proven state direction.

The seizure likely caused high-confidence immediate disruption to QScan/QTRouter’s control plane, but only moderate-confidence durable impact: the operators may retain compromised routers, proxy capacity, tooling, and exploit knowledge. Reconstitution would show new command domains, bot check-ins migrating to replacement infrastructure, renewed high-volume scanning, or the same certificate/DNS and routing patterns—covering ATT&CK T1595, T1190, and T1090.

Victim-side DNS or traffic to the seized domains warrants exposure review, not automatically incident response. Escalate on exploit-success traces, unauthorized OpenWrt/firmware or persistence changes, unknown administrator sessions, configuration or credential access, QTRouter proxy activity, staging, or confirmed outbound data transfer. The seizure and Chinese-linked infrastructure do not independently prove state direction.

Close the operational discussion. Alex reports a reproducible pre-auth RCE chain in PaperCut, says the first emergency fix was bypassable, and advises Emergency Patch Release 2 after evidence capture; this conflicts with the handoff's narrower statement that fixes exist only for versions 25 and 26 because Alex now sees coverage for 24, 25, and 26. Tomas confirms ten malicious @7nohe/openapi-react-query-codegen releases with install-time execution and multi-domain credential exposure. Viktor ranks exploited Cosmos EVM first, unpatchable Ajna v2 second, then remediated Rain and disabled Sandbox bridges. Lena assesses immediate but not necessarily durable QTFY disruption. Give a decision-ready order for a resource-constrained CISO tonight, explicitly resolve the PaperCut patch/version discrepancy, and name the minimum validation gate before each affected service or pipeline returns to operation. Argue against the ranking if operational dependencies justify it.

Halil, I would not apply Viktor’s ranking universally. Tonight’s order is dependency-driven: exposed PaperCut first; then any CI environment containing the compromised npm package; then Cosmos EVM or Ajna only where the organization operates or funds those systems. A live Cosmos chain moves to first because losses can continue. The PaperCut discrepancy is settled: current reporting says all versions may be vulnerable, while Emergency Patch Release 2 is available for 24, 25, and 26. The handoff’s 25/26 limitation is outdated. Older branches stay isolated pending a vendor-supported upgrade path—do not infer they are safe.

Minimum return gates: PaperCut: preserve evidence, stage and install Release 2, verify no suspicious pc-app.exe execution or persistence; rebuild and rotate credentials from a clean system if compromise is found. npm pipeline: remove all affected releases from lockfiles, caches, runners, and artifacts; rotate exposed cloud, repository, registry, CI, and developer credentials; then complete one clean rebuild on fresh runners with reviewed source changes. Cosmos EVM: remain halted until the approved fixed build passes exploit replay against a state copy and balances reconcile.

Ajna v2: the exploited immutable deployment does not return—migrate to a reviewed replacement and reconcile funds first. Rain/Sandbox: remediation or bridge shutdown is containment, not clearance; require transaction reconciliation and exploit-regression testing before reopening. Independent evidence for Rain’s remediation remains incomplete, so keep it closed. QTFY: hunt now, but do not create an outage solely because infrastructure was disrupted; any locally affected system returns only after persistence review, known-good rebuild where integrity is uncertain, and credential rotation.

For the ATF incident, separate the confirmed facts—unauthorized access to a standalone system and DOJ major-incident classification—from Qilin's claim that investigative-target files were compromised. What evidence would close the gap between system access and sensitive-data exfiltration, and what should federal or law-enforcement defenders do tonight without assuming the enterprise network was breached? Give a position on whether this is an enterprise compromise, a contained but high-impact enclave incident, or still indeterminate.

Confirmed: ATF says the affected standalone system contained information about investigative targets, was separate from enterprise, case-management, laboratory, and eForms systems, and was quickly shut down. DOJ’s “major incident” designation triggers formal federal reporting; it does not prove enterprise compromise or exfiltration. Qilin claimed responsibility but reportedly supplied no validating data sample.

Position: Treat this as a contained but potentially high-impact enclave incident. Enterprise compromise is not established. Exfiltration remains indeterminate. Close that gap with a forensic image showing file access, staging, compression, deletion, or transfer tooling; correlated firewall/proxy/DNS/flow records showing destination and byte volume; endpoint command/process history; authentication and token-use records; and a Qilin sample whose contents and metadata can be mapped uniquely to that system. A leak-site assertion is a burglar claiming he emptied the safe without showing the contents.

Tonight: Keep the system disconnected and do not restart it. Image storage and preserve snapshots, timestamps, application logs, EDR, boundary-network, identity, backup, and administrative-access records. Inventory exactly which investigative files and people were exposed. Map shared accounts, management channels, backup paths, removable media, and transfer gateways; rotate credentials or tokens found on the enclave from a clean host after preserving their history. James Okafor agrees: expand enterprise containment only if evidence shows credential reuse, cross-boundary sessions, or traversal—not merely because Qilin said “network.”

NIST warns deepfake-detection performance can fall 45–50% outside laboratory conditions, while fake Apple Support calls and remittance scams combine cloned voices with stolen personal data, phishing pages, and live 2FA capture. Take the non-obvious defensive position: which controls still work when media detection is unreliable, and what should a CISO change tonight in help-desk, payment, and account-recovery workflows? Do ... [arg clipped]

The NIST figure is modality-specific: open-source detectors lost 50% AUC on video, 48% on audio, and 45% on images against an in-the-wild benchmark. AnonyMousKIT shows why this matters operationally: it combines impersonation calls with device data, phishing pages, and live 2FA capture. Unknown: the evidence does not establish exceptional voice realism or identify the model used.

My non-obvious position is to remove media from the authorization path. Tonight:

• Help desk: Never let voice, video, caller ID, personal trivia, or an OTP authorize a reset. Require a pre-enrolled device or phishing-resistant credential; otherwise use dual approval, an independently maintained callback channel, and a cooling-off period.
• Payments: Treat executive audio/video as request initiation only. Require approval inside the trusted payment system, two-person authorization, and independent verification of new beneficiaries or changed bank details.
• Account recovery: Prevent agents from bypassing stronger factors. Separate credential reset from recovery-channel changes, notify existing channels, revoke active sessions, and delay high-risk changes.

Detectors can prioritize investigation, but they should never approve a caller, payment, or recovery request. The durable control is transaction-bound verification outside the channel carrying the impersonation.

Two late inputs: Alex says the ATF major-incident designation does not prove enterprise compromise or exfiltration, so response should preserve the standalone system's evidence and test trust boundaries before widening containment. Isabelle says operational deepfake detection degrades sharply and AnonyMousKIT succeeds through workflow abuse—personalized calls, phishing, and live 2FA capture—not necessarily exceptional synthesis. Close the room... [arg clipped]

Alex is right: keep ATF containment bounded tonight. Preserve and image the powered-down standalone system, export identity/network/administrative logs, and test for shared credentials, management paths, backups, or cross-boundary traffic. Expand containment only if those checks show traversal; Qilin attribution and exfiltration remain unconfirmed. Return requires a known-good rebuild, exposed credentials rotated from a clean host, and no unexplained boundary activity.

Isabelle’s point changes the defensive emphasis: NIST reports 45–50% detector degradation in operational use, while AnonyMousKIT combines personalized calls, phishing links, and live credential/2FA interception. Make detectors secondary. Tonight, require directory-sourced callbacks and second-person approval for account recovery, privileged access, payments, or sensitive-data release; never accept voice familiarity or caller-supplied contact details as authentication.