Iranian APTs Exploit PaperCut Vulnerability in Global Cyber Attacks

In May 2023, Microsoft revealed that two Iranian state-backed hacking groups — Mint Sandstorm (linked to Iran's IRGC) and Mango Sandstorm (linked to Iran's Ministry of Intelligence) — had joined an ongoing wave of attacks targeting CVE-2023-27350, a critical vulnerability in PaperCut print management software. The flaw allowed attackers to take over PaperCut servers without any credentials. Earlier exploitation had already been linked to the Clop and LockBit ransomware gangs. The Iranian groups used the same vulnerability to gain access to organizational networks across multiple sectors globally.

Two groups were identified. Mint Sandstorm (also known as Phosphorus or APT35) is linked to Iran's Islamic Revolutionary Guard Corps and is one of Iran's most active cyber-espionage actors. Mango Sandstorm (also known as Mercury or MuddyWater) is linked to Iran's Ministry of Intelligence and Security. Both groups are tracked by Microsoft as separate, distinct actors. Ransomware gangs — specifically Lace Tempest (linked to Clop) — also exploited the same vulnerability, making this a case where state-sponsored and criminal actors used the same flaw simultaneously.

For the Iranian groups, the primary goal was intelligence collection — gaining initial access to organizational networks through a widely deployed and trusted software product. Mint Sandstorm's opportunistic approach suggests the group was using PaperCut exploitation as a broad initial access mechanism to identify high-value targets for follow-on espionage. Mango Sandstorm focused on extending existing operations rather than initiating new campaigns. Separately, ransomware actors were using the same vulnerability for financial extortion through Clop and LockBit ransomware deployments.

The scope was very broad. PaperCut software is used by over 100 million users at more than 70,000 organizations globally — including large enterprises, universities, hospitals, and government agencies. Mint Sandstorm's exploitation was described as opportunistic, meaning it targeted organizations across multiple sectors and geographies without specific victim selection. Any organization running an unpatched, internet-accessible PaperCut server was at risk. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on April 21, 2023, confirming active exploitation at scale.

Any organization using PaperCut MF or NG software was potentially at risk, given the opportunistic nature of the exploitation. PaperCut is especially common in universities, schools, government agencies, healthcare organizations, and large enterprises — all of which use the software for print management. Educational institutions and government bodies were specifically noted as high-risk targets given the software's widespread adoption in those sectors.

CVE-2023-27350 is a pre-authentication remote code execution vulnerability — meaning an attacker doesn't need any username or password to exploit it. By sending a specially crafted HTTP request to a PaperCut server's admin interface (typically accessible on port 9191 or 9192), an attacker can execute arbitrary code on the server with the same privileges as the PaperCut application. From there, they can download and deploy additional tools, establish persistence, move laterally through the network, and exfiltrate data. Public proof-of-concept exploits were released after disclosure, allowing threat actors to rapidly integrate the attack into their operations.

PaperCut is a widely trusted, ubiquitous print management platform used by large numbers of organizations across government, education, and enterprise. Its broad deployment — 100 million users at 70,000+ organizations — makes it an ideal mass exploitation target. For Iranian state-sponsored actors, opportunistic exploitation of widely deployed software provides a rapid, low-effort path into many different organizations simultaneously, allowing them to identify and prioritize high-value intelligence targets from a large pool of initial access victims. The pre-authentication nature of the flaw made exploitation trivial and the public PoC eliminated the need for custom exploit development.