Reported by 9 outlets
Clop created custom web shell for Windchill data theft attacks
Why this score
- Breadth
- 2.00 / 2.0 · 9 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.47 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Clop, also tracked as Cl0p, is exploiting CVE-2026-12569, a CVSS 9.3 unauthenticated remote code execution vulnerability in PTC Windchill PDMlink and FlexPLM, to deploy a custom JavaServer Pages web shell built specifically for the platform. The implant, analyzed by ReliaQuest, reads Windchill configuration files, decrypts encrypted values from the application keystore to harvest directory-management and LDAP manager credentials, enumerates file vaults, and exfiltrates engineering data without separate attacker tooling. The event record carries concrete indicators including the malicious request header X-windchill-req, known webshell paths such as /Windchill/login/7c0a0a34c9d8d53b.jsp, and the C2 IP 5.180.41.35; PTC's advisory confirms patches for versions including 13.1.3, 13.1.2, 13.1.1, 13.0.2, 12.1.2, 12.0.2, 11.2.1, 11.1 M020, and 11.0 M030, with exploitation reports dating back to June.
This is not a generic webshell repurposed for a new target; it is an application-specific evolution of Clop's mass-exploitation playbook, reflecting detailed knowledge of Windchill's internal APIs, database schema, and file-vault structure. The events note that previous Clop campaigns hit more than 2,770 organizations worldwide through MOVEit Transfer alone, and this campaign extends that same supply-chain extortion model to product lifecycle management systems that store pre-release designs, supplier data, and intellectual property. PTC reports over 30,000 global customers and more than 1,500 brand and retail customers using FlexPLM, concentrating exposure in aerospace, defense, automotive, and manufacturing sectors. The claim the timeline does not spell out on its own is that the attacker does not merely steal files but also decrypts keystore-stored credentials that could unlock connected enterprise services, turning a single PLM breach into a broader network foothold rather than a contained data-theft event.
Defenders should apply PTC patches immediately, specifically the SUP updates 13.1.3 and 13.1.2 or the standalone CPSXB patches for 13.1.1, 13.0.2, 12.1.2, 12.0.2, 11.2.1, 11.1 M020, and 11.0 M030, and restrict internet exposure of the Windchill login endpoint where operationally feasible. Hunt for POST requests to /Windchill/login/*.jsp matching 16-character lowercase hexadecimal filenames, for shorter six-hex variants, and for dpr_ prefixes, because legitimate Windchill traffic does not POST to that path. Block the C2 IP 5.180.41.35 at the perimeter, add WAF or IDS rules dropping requests containing the X-windchill-req header, scan filesystems under .../Windchill/codebase/login/ for suspicious .jsp files, and check for the file flst.txt in /tmp or the working directory as confirmation of attacker file-listing activity. Alert on multi-megabyte POST responses originating from .jsp files in the application tier, and hash-check suspicious shells against 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c.
Watch for new webshell filenames beyond the currently known six, because the attacker names shells with 16 lowercase hex characters or dpr_ prefixes and may deploy new variants at any time. Monitor exposure metrics: Censys observed fewer than 100 internet-facing Windchill instances as of June 1, 2026, with a decline to a little over 80 by July 20, meaning remaining exposed systems face concentrated scanning. A second development that would change the assessment is confirmation of expanded exploitation through the additional vulnerabilities referenced in PTC's advisory, specifically the critical RCE CVE-2026-77645 (CVSS 9.0) and the high SSRF CVE-2026-77646 (CVSS 8.6), which could expand the campaign beyond the single CVE-2026-12569 chain currently in focus.
Timeline
-
original reporting
Clop created custom web shell for Windchill data theft attacks
bleepingcomputer.com · 56d ago · August 18th, 2026
A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. Cybersecurity company ReliaQuest analyzed the web shell after it is believed to have been deployed in recent data theft attacks exploiting CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill. ReliaQuest says the implant is not a generic web shell repurposed for the attacks, but was instead built with detailed knowledge of Windchill's internal APIs, database schema, keystore, and file-vault structure. "This appears to be an application-specific evolution of Clop's established mass-exploitation playbook," ReliaQuest said in a report shared with BleepingComputer. The researchers say they found the web shell during the intelligence collection process. The researchers say the activity is likely linked to Clop based on extortion emails containing addresses used on the ransomware gang's data leak site, previously observed X-windchill-req headers also used in the web shell, and TTps commonly used by the threat actors. The Clop extortion gang has a long history of breaching enterprise platforms in data theft attacks, with previous campaigns targeting Accellion FTA , GoAnywhere MFT , SolarWinds Serv-U FTP , Cleo , and MOVEit Transfer file-sharing servers, the latter affecting more than 2,770 organizations worldwide . Clop extortion
-
update from ptc.com
PTC Trust Center advisory for CVE-2026-12569 (Windchill / FlexPLM RCE)
ptc.com · 118d ago · June 17th, 2026
PTC published its first advisory updates for CVE-2026-12569 on June 17, 2026, noting the critical remote code execution vulnerability in Windchill and FlexPLM and providing initial remediation steps via eSupport article CS473270. The change log records updates at 2:16 PM ET and 9:28 PM ET on June 17, followed by IOC releases and patch availability announcements on June 18.
-
update from nvd.nist.gov
CVE-2026-12569 Detail (NVD)
nvd.nist.gov · 118d ago · June 18th, 2026
NVD's record describes a critical RCE in PTC Windchill PDMLink and PTC FlexPLM exploitable through deserialization of untrusted data, scored 9.3 Critical (CVSS v4) by CNA PTC, with CWE-20 and CWE-502 and affected builds spanning releases prior to 11.0 M030 through 13.1.3. It records the CISA KEV addition on June 25, 2026 with a federal remediation due date of June 28, 2026.
-
update from ransom-isac.org
Cl0p Exploitation of PTC Windchill & FlexPLM (CVE-2026-12569)
ransom-isac.org · 84d ago · July 22nd, 2026
Ransom-ISAC's coordinated threat advisory with eCrime.ch and DEFUSED assesses that Cl0p exploited CVE-2026-12569 as a zero-day in early June 2026, chaining a pre-authentication FlexPLM WSDL information disclosure (CVSS 7.5) with the Windchill login servlet flaw for unauthenticated RCE (CVSS 9.8). It documents extortion emails sent from July 20, 2026 with the subject line Windchill PDMLink module serious data leak, confirms victim sectors of manufacturing, automotive, aerospace, and retail/apparel, and as of July 22 noted Cl0p had not yet listed victims on its leak site. Includes a structural YARA rule for the JSP webshells and an incident-observed C2 at 79.141.160.78.
-
update from bleepingcomputer.com
BleepingComputer: Clop ransomware targets Windchill, FlexPLM in data theft attacks
bleepingcomputer.com · 81d ago · July 24th, 2026
It cites ReliaQuest observations from the prior day, notes PTC began releasing patches on June 17, and mentions CISA added the flaw to its KEV catalog on June 25.
-
update from thehackernews.com
The Hacker News: Cl0p affiliates target internet-exposed PTC Windchill and FlexPLM
thehackernews.com · 80d ago · July 25th, 2026
It notes deployment of hex-named JSP webshells, references Censys exposure data showing fewer than 100 exposed instances as of June 1, and lists network IOCs including 5.180.41.35.
-
update from reliaquest.com
Clop Returns with Custom Implant in Mass-Extortion Campaign
reliaquest.com · 57d ago · August 18th, 2026
ReliaQuest Threat Research (authors John Dilgen and Connor Short) dissects the custom Windchill web shell deployed after CVE-2026-12569 exploitation: a single S command decrypts the application keystore and returns LDAP manager and administrative credentials in plaintext, a built-in Java class loader runs attacker-supplied bytecode entirely in memory, and vault enumeration writes a repository map to flst.txt. Commands ride the X-windchill-req header with GZIP-compressed responses, and the report publishes implant SHA-256 321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf. ReliaQuest assesses with moderate confidence that copycat actors will adopt the vulnerability as public exploit code spreads.
-
update from gbhackers.com
Cl0p Hackers Exploit PTC Windchill Vulnerability to Deploy Custom Web Shell and Steal Data
gbhackers.com · 55d ago · August 19th, 2026
The Cl0p ransomware and extortion operation is likely exploiting a critical PTC Windchill vulnerability to deploy a purpose-built Java web shell that can harvest credentials, map engineering data vaults, and exfiltrate files without requiring additional attacker tooling. Tracked as CVE-2026-12569, the vulnerability is a CVSS 9.3 remote code execution issue affecting PTC Windchill PDMlink and […] The post Cl0p Hackers Exploit PTC Windchill Vulnerability to Deploy Custom Web Shell and Steal Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Cl0p Hackers Exploit PTC Windchill RCE Flaw to Deploy Custom Data-Theft Web Shell
cyberpress.org · 55d ago · August 19th, 2026
ReliaQuest Threat Research assessed that the campaign is highly likely linked to Cl0p, also known as Cl0p. The vulnerability has a CVSS score of 9.3 and affects PTC Windchill , a widely used product lifecycle management platform that stores engineering documents, product designs, and other sensitive intellectual property. Unlike common web shells that mainly provide remote command execution, this implant is tailored to Windchill’s internal architecture. The activity highlights the serious risk posed by internet-facing enterprise applications holding valuable data. A compromised Windchill server could expose not only engineering files but also credentials that enable access to connected enterprise services. Cl0p’s Windchill Data-Theft Webshell The custom JavaServer Pages (JSP) web shell contains functions specifically designed to abuse Windchill components. One command can retrieve directory-management and administrative credentials stored by the platform. According to the research, the shell reads Windchill configuration files and decrypts encrypted values from the application keystore. These may include LDAP manager p
-
update from cyberscoop.com
The long tail of Clop’s PTC hack is just beginning to emerge
cyberscoop.com · 55d ago · August 19th, 2026
A notorious cybercrime group has once again exploited a critical zero-day vulnerability on a large scale, claiming it stole data from dozens of organizations, including some of the world’s largest publicly traded companies. Clop, a prolific but calculated data theft extortion group that’s been active since 2020, began sending threatening emails to its alleged victims in mid-July, according to researchers. The fallout from the attack spree, which followed a familiar pattern for Clop and its targeted pool of victims, is still evolving as companies hunt for potential signs of compromise. The vulnerability at the center of Clop’s latest campaign affects a pair of software products from PTC — Windchill and FlexPLM — which manufacturers and retailers, particularly in the manufacturing, aerospace, and automotive industries, use to automate supply chain systems and manage product lifecycles. “This continues Clop’s trend of targeting SaaS logistics companies’ platforms with zero-days and carrying out mass-exploitation campaigns,” Allan Liska, field chief information security officer at Recorded Future, told CyberScoop. The Cybersecurity and Infrastructure Security Agency added the defect, which