CTI · reviewed · 2026-08-19

Clop created custom web shell for Windchill data theft attacks

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1100 Web Shell Persistence
• T1212 Exploitation for Credential Access Credential Access
• T1005 Data from Local System Collection
• T1041 Exfiltration Over C2 Channel Exfiltration
• T1081 Credentials in Files Credential Access

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• 5.180.41.35 ipv4 · expired · corroborated
• 79.141.160.78 ipv4 · expired
• 321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf sha256 · expired

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://bleepingcomputer.com
• https://gbhackers.com
• https://cyberpress.org