Clop gang targets Windchill, FlexPLM in data theft attacks

1. Executive summary

The Clop ransomware gang (also tracked as Cl0p) is actively exploiting CVE-2026-12569, a critical vulnerability (CVSS 9.3) in PTC Windchill and FlexPLM product lifecycle management (PLM) platforms, to conduct data theft and extortion campaigns against Internet-exposed instances. The vulnerability — classified as CWE-20 (Improper Input Validation) and CWE-502 (Deserialization of Untrusted Data) — enables arbitrary code execution on vulnerable systems, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-25 following confirmed in-the-wild exploitation involving JSP webshell deployment. EMEA financial services organisations running Windchill or FlexPLM in their supply chain or manufacturing environments face risk of data exfiltration and extortion. Attribution to Clop/Cl0p is unconfirmed — the actor has no MITRE ATT&CK profile in verified reference data.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 19 — reporting of major ICT-related incidents to competent authorities	Active exploitation of a CISA KEV-listed critical vulnerability (CVSS 9.3) enabling arbitrary code execution and data theft on Windchill/FlexPLM instances, if the organisation runs these platforms.	If a Windchill/FlexPLM instance is compromised or is determined to be exposed and vulnerable, assess whether the incident meets the major-incident classification threshold under Art. 18 and report accordingly.
DORA Art. 24 — digital operational resilience testing — general requirements	A CISA KEV-listed vulnerability with confirmed active exploitation and webshell deployment on Internet-exposed PLM platforms.	Prioritise vulnerability scanning and penetration testing of externally facing Windchill/FlexPLM instances as part of the ICT resilience testing programme.
NIS2 Art. 21(2)(d) — supply chain security measures	Windchill and FlexPLM are third-party PLM platforms integrated into manufacturing and supply-chain operations; the vulnerability is under active exploitation.	Ensure supply-chain security measures extend to PLM platform vulnerability management and that third-party-hosted Windchill/FlexPLM instances are covered.

3. Technical analysis & attack chain

Confirmed attack chain

Target selection — Clop/Cl0p identifies Internet-exposed PTC Windchill and FlexPLM instances. These PLM platforms are commonly deployed in manufacturing and engineering environments and may be less rigorously patched than core financial systems.
Initial access via CVE-2026-12569 — Attackers exploit CVE-2026-12569 (CVSS 9.3, CWE-20 Improper Input Validation / CWE-502 Deserialization of Untrusted Data) against unpatched, Internet-facing Windchill/FlexPLM instances. The vulnerability permits arbitrary code execution on the target system.
Webshell deployment — Confirmed exploitation involves the dropping of JSP webshells onto vulnerable Windchill systems, providing attackers with persistent interactive access to the compromised host.
Data access and exfiltration — The campaign is characterised as data theft extortion: attackers access and exfiltrate data from compromised instances rather than deploying ransomware for encryption. The extortion model follows Clop's established pattern of stealing data and threatening public release.

Technical specifics

Vulnerable products: PTC Windchill and PTC FlexPLM (product lifecycle management platforms).
Vulnerability mechanism: CVE-2026-12569 involves improper input validation (CWE-20) and deserialization of untrusted data (CWE-502). The deserialization component is consistent with the observed JSP webshell deployment — deserialization flaws in Java-based applications (Windchill runs on Java) commonly allow arbitrary file write or code execution leading to webshell placement.
Post-exploitation artefact: JSP webshells are being deployed to compromised Windchill instances. Specific webshell filenames, paths, and hashes are not provided in the available source material but PTC's advisory is reportedly being updated with IOCs.
CISA KEV status: Added 2026-06-25. EPSS score is 2%, which is low relative to the CVSS 9.3 rating — this likely reflects the niche deployment profile of Windchill/FlexPLM rather than low exploitability. The KEV listing itself confirms active exploitation.

Confidence caveats

Attribution to "Clop" / "Cl0p" is unconfirmed — the actor has no MITRE ATT&CK profile in verified reference data. The attribution rests on reporting by BleepingComputer and DataBreaches.net; treat as single-sourced until corroborated by additional vendor reporting.
Specific exploit payload details, C2 infrastructure, lateral movement techniques, and exfiltration methods are not described in the available source material. PTC's advisory is reportedly being updated with additional IOCs — clients should monitor for the latest version.

4. Mitigation & containment

P1 — Within 24 hours

Identify all Windchill and FlexPLM instances across the estate, including those hosted by third parties or in manufacturing/supply-chain environments. Inventory Internet-facing instances as priority.
Check patch status against PTC's advisory for CVE-2026-12569. Apply the vendor fix immediately to any vulnerable instance. PTC's advisory is the authoritative source for patch versions and remediation steps.
Isolate or restrict Internet exposure of Windchill/FlexPLM instances wherever possible. Move behind VPN or zero-trust network access if external access is not strictly required.
Hunt for JSP webshells on all Windchill/FlexPLM hosts. Focus on:
Unexpected .jsp files in web application directories.
Recently modified or newly created .jsp files outside expected application deployment paths.
JSP files in temp directories, upload directories, or non-standard webroot locations.

P2 — Within 72 hours

Review PTC's updated advisory for the latest IOC list and incorporate into EDR/SIEM detection rules.
Conduct forensic review of any instances that were Internet-exposed while vulnerable — check web server access logs for anomalous POST requests, unexpected JSP page accesses, and large outbound data transfers consistent with exfiltration.
Block known C2 and exfiltration destinations if IOCs become available from PTC's advisory or CISA's KEV entry.
Notify third-party hosting providers if Windchill/FlexPLM is managed externally — confirm patch status and request written attestation.

P3 — Within 7 days

Implement WAF rules to filter exploitation attempts against CVE-2026-12569 if a vendor-provided signature or virtual patch is available.
Review and tighten deserialization controls on Windchill/FlexPLM Java application servers per PTC hardening guidance.
Update asset management to ensure Windchill/FlexPLM is included in routine vulnerability scanning and patch management cycles going forward.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, filenames) are available in the provided source material. PTC's advisory is reportedly being updated with IOCs — clients should retrieve the latest version directly from PTC.

Behavioural indicators

Behaviour	Where to observe	Confidence
Unexpected JSP file creation in Windchill web application directories	Filesystem monitoring, EDR file-write events, web server directory enumeration	High — confirmed by source reporting
Anomalous inbound HTTP/HTTPS requests targeting Windchill/FlexPLM endpoints	Web server access logs, WAF logs, network IDS	Medium — consistent with exploitation of Internet-exposed instances
Large outbound data transfers from Windchill/FlexPLM hosts	Network flow logs, egress firewall logs, DLP	Medium — consistent with data theft extortion campaign model
Access to newly created JSP pages from external IP addresses	Web server access logs, SIEM correlation	Medium — webshell interaction pattern

6. Detection

Insufficient indicators to author detection rules. No specific webshell filenames, file paths, strings, hashes, network indicators, or command-line artefacts are present in the provided source material. PTC's advisory is reportedly being updated with IOCs — detection rules should be authored once those artefacts are available.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

CVE	CVSS	Exploited	EPSS	Summary
CVE-2026-12569	9.3 Critical	⚠ KEV 2026-06-25	2%	A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerabil…

7. Sources

DataBreaches.net — "Clop gang targets Windchill, FlexPLM in data theft attacks" — https://databreaches.net/2026/07/24/clop-gang-targets-windchill-flexplm-in-data-theft-attacks/ — 2026-07-24
BleepingComputer — "Clop ransomware targets Windchill, FlexPLM in data theft attacks" — https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks/ — 2026-07
Help Net Security — "JSP webshells being dropped on unpatched PTC Windchill instances" — https://www.helpnetsecurity.com/2026/06/29/ptc-windchill-cve-2026-12569-exploited/ — 2026-06-29

8. Adverse Trace position

CVE-2026-12569 is a CVSS 9.3 critical vulnerability with confirmed active exploitation (CISA KEV, added 2026-06-25) involving JSP webshell deployment and data theft — the severity is not inflated. The threat is real and ongoing, but the attack surface in EMEA financial services is likely narrow: Windchill and FlexPLM are PLM platforms more commonly found in manufacturing and engineering environments than in core banking or trading infrastructure. Clients should nonetheless confirm whether Windchill/FlexPLM is deployed anywhere in their estate or by their third-party providers, patch immediately, and hunt for webshells on any previously exposed instances. Attribution to Clop/Cl0p is unconfirmed (no MITRE ATT&CK profile in verified data; single-sourced to vendor reporting) — we will update this advisory if additional corroboration or IOCs emerge from PTC's evolving advisory or from additional vendor publications.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.