Cl0p Ransomware Windchill/FlexPLM Campaign — New Details from ReliaQuest, Ransom-ISAC

The Cl0p affiliate exploits CVE-2026-12569 (CVSS 9.3) in PTC Windchill and FlexPLM systems by chaining a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet to reach remote code execution. Attackers deploy JSP webshells under /Windchill/login/, enumerate filesystems, stage data for exfiltration, and send extortion emails with the exact subject line "Windchill PDMLink module serious data leak" to hundreds of users per victim. The campaign has been active since July 20, targeting aerospace, automotive, manufacturing, and retail/apparel sectors, and CISA added the CVE to KEV on June 25. As of July 22, no victims appeared on the Cl0p dark web leak site.

This is not a generic ransomware alert: enterprise PLM systems hold proprietary design data and supply-chain specifications that, once exfiltrated, enable downstream manufacturing disruption far beyond the initial victim. The event data notes hundreds of extortion contacts per victim, which suggests broad internal exposure rather than a narrow IT compromise, and the absence of listed victims by July 22 implies attackers are still negotiating privately rather than moving to public shaming. That delay gives defenders a narrow window before the campaign shifts from stealth to public extortion, making rapid patching more valuable than it would be for a routine malware wave.

Patch CVE-2026-12569 immediately on any internet-facing PTC instance. Hunt for JSP webshells specifically under /Windchill/login/ and review filesystem enumeration and staging logs in the Windchill and FlexPLM directories. Monitor for extortion emails using the exact subject line and block associated sender domains; treat any unpatched, exposed instance as potentially compromised given the June 25 KEV entry.

Watch for two shifts: publication of victim names on the Cl0p dark web leak site, which would confirm the campaign has moved past private negotiation, and any new exploitation telemetry targeting versions not covered by the current advisory. A change in the IoC set, especially different webshell paths or revised extortion email subjects, would indicate campaign adaptation.