Reported by 5 outlets
Clop Group Claims Massive Data Heist from Shell, Philips, GE via PTC Flaw Clop ransomware group claims massive data theft from Shell, Phil
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The Clop extortion group is exploiting CVE-2026-12569, a critical improper input validation and unsafe deserialization flaw in PTC Windchill and FlexPLM, to steal engineering data from industrial targets. Clop has listed 43 organizations on its dark web leak site, including Shell, Philips, and General Electric, with claimed exfiltration volumes ranging from 1 GB to 391 GB (GE) and 89 GB (Shell) of engineering drawings, product blueprints, and project plans. The vulnerability allows unauthenticated remote code execution through malicious requests to vulnerable PTC instances, and attackers deploy persistent JSP web shells inside /Windchill/login/ directories with hexadecimal filenames such as dpr_0123abcd.jsp to maintain access and collect data.
This campaign is not ransomware encryption but a data-theft extortion operation that continues Clop's history of mass exploitation of enterprise platforms after MOVEit and Oracle EBS. PTC released patches on June 17, 2026, yet researchers at ReliaQuest confirmed active zero-day exploitation began in early June, weeks before disclosure. CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities catalog on June 26, 2026, pushing federal civilian agencies onto an emergency patch timeline. The exposure profile is particularly dangerous for manufacturers and aerospace firms because PLM systems hold unreleased product designs, supplier contracts, and bills of materials rather than ordinary consumer records, making intellectual property loss a direct competitive and regulatory risk even without a conventional breach notification trigger.
Defenders running Windchill or FlexPLM must apply PTC's June 2026 patches immediately across all nodes, including file servers and replicas, and restrict internet exposure of login endpoints behind VPN or zero-trust access where business needs allow. Exact hunt actions include blocking attacker C2 IP 5.180.41.35 at the perimeter, searching web server logs for POST requests to /Windchill/login/*.jsp, scanning the filesystem for .jsp files matching the 16-character lowercase hex pattern under .../Windchill/codebase/login/, checking for the file flst.txt in /tmp or the Windchill working directory, and adding WAF rules blocking the header X-windchill-req: which has no legitimate use. PTC also published an Apache LocationMatch control to deny access to the servlet path com.ptc.wvs.server.publish.Publish and an IIS URL Rewrite equivalent for installations prior to the patch.
The assessment could shift sharply if Clop publishes additional victim names or if forensic reviews at GE, Philips, or Shell confirm personal or employee data mixed with engineering files. A second key development would be evidence of opportunistic scanning by actors beyond Clop, which typically follows once a severe RCE in a widely deployed enterprise platform is tied to confirmed extortion and public IOCs. Until either development occurs, the priority remains confirming patch coverage, removing internet-facing PLM portals, and preserving logs from the July 20-26 confirmed exploitation window and the weeks before it.
Timeline
-
original reporting
📰 Clop Group Claims Massive Data Heist from Shell, Philips, GE via PTC Flaw Clop ransomware group claims massive data theft from Shell, Phil
cyber.netsecops.io · 34d ago · September 9th, 2026
📰 Clop Group Claims Massive Data Heist from Shell, Philips, GE via PTC Flaw Clop ransomware group claims massive data theft from Shell, Phil
via Mastodon https://cyber.netsecops.io/articles/clop-ransomware-exploits-ptc-vulnerability-hits-shell-philips-ge/?utm_source=mastodon&utm_medium=social&utm_campaign=daily
-
update from ptc.com
PTC Trust Center Advisory: Remote Code Execution Vulnerability in PTC Windchill and FlexPLM (CVE-2026-12569)
ptc.com · 119d ago · June 17th, 2026
PTC published a critical advisory on June 17, 2026 identifying CVE-2026-12569, an improper input validation and unsafe deserialization flaw in PTC Windchill PDMLink and FlexPLM that allows remote code execution. The advisory notes patches began shipping the same day for affected versions including 11.0 M030 through 13.1.3 and that the vulnerability could allow an unauthorized user to execute code remotely. PTC also began publishing network IOCs such as attacker C2 IP 5.180.41.35 and known JSP webshell patterns like /Windchill/login/[0-9a-f]{16}.jsp, along with detection rules for the malicious header X-windchill-req.
-
update from cisa.gov
CISA Adds Exploited PTC Windchill RCE Flaw to KEV Catalog (CVE-2026-12569)
cisa.gov · 110d ago · June 25th, 2026
CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities Catalog on June 25, 2026, citing evidence of active exploitation. The bulletin confirms the vulnerability affects PTC Windchill and FlexPLM and requires federal civilian agencies to apply patches or mitigations on an emergency timeline per BOD 26-04. This was the first-ever PTC product vulnerability added to CISA KEV, signaling widespread in-the-wild exploitation rather than theoretical risk.
-
update from thehackernews.com
CISA Confirms Active Exploitation of PTC Windchill RCE and Web Shell Deployment (Jun 26, 2026)
thehackernews.com · 109d ago · June 26th, 2026
On June 26, 2026, The Hacker News reported CISA's KEV addition for CVE-2026-12569 (CVSS 9.3) and noted PTC confirmed heightened threat activity with attackers deploying persistent JSP web shells in /Windchill/login/ directories. The article lists additional attacker C2 IPs including 38.60.157.212 and 216.152.148.54, and describes hunting hints such as searching HTTP logs for POST to /Windchill/login/*.jsp, scanning for .jsp files matching hex patterns, checking for flst.txt in /tmp, blocking header X-windchill-req:, and restricting internet exposure of Windchill login endpoints.
-
update from shattered.io
Clop Ransomware Exploits PTC Windchill Zero-Day: 43 Victims Named (Aug 31, 2026)
shattered.io · 43d ago · August 31st, 2026
Shattered.io published a detailed analysis on August 31, 2026 documenting the Clop group's exploitation of CVE-2026-12569 in PTC Windchill and FlexPLM, confirming 43 listed victims including GE, Philips, and Shell. The report states researchers at ReliaQuest confirmed active exploitation using a custom Java-based webshell placed inside /Windchill/login/ with hexadecimal filenames. It also notes Clop began exploiting the flaw as a zero-day by early June before the June 17 patch, and that SecurityWeek put the victim count at 43 with claimed data volumes from roughly 1 GB to multiple terabytes per organization.