Cl0p Hackers Exploit PTC Windchill Vulnerability to Deploy Custom Web Shell and Steal Data

The Cl0p ransomware and extortion operation is likely exploiting a critical PTC Windchill vulnerability to deploy a purpose-built Java web shell that can harvest credentials, map engineering data vaults, and exfiltrate files without requiring additional attacker tooling.

Tracked as CVE-2026-12569, the vulnerability is a CVSS 9.3 remote code execution issue affecting PTC Windchill PDMlink and FlexPLM.

PTC says exploitation can occur through deserialization of untrusted data, allowing an unauthenticated attacker to execute code remotely on vulnerable systems.

Rather than deploying a generic command shell, the operators use a customized JavaServer Pages (JSP) implant designed around Windchill’s internal APIs, keystore mechanisms, database structure, and file-vault architecture.

The approach gives the threat actor a complete data-theft platform immediately after initial access.

The web shell imports Windchill-specific Java classes, including MethodContext, WTConnection, and WTKeyStoreUtil, enabling it to operate within the application process and use the product’s trusted database access.

This materially complicates detection: database activity may appear under Windchill’s normal service identity rather than an unfamiliar account or host.

ReliaQuest also found the shell uses a custom HTTP header, X-windchill-req, for command delivery and GZIP-compressed responses, reducing visibility for defenses that do not log HTTP headers, decrypt TLS traffic, and inspect compressed content.

One of the shell’s most damaging functions decrypts credentials stored in Windchill’s keystore. A single command can recover the LDAP manager password, administrative credentials, object-storage secrets, and other encrypted configuration values in plaintext.

This changes the incident from a PLM-server compromise into a potential identity compromise. LDAP credentials can provide access to Active Directory-integrated resources, VPN services, email infrastructure, databases, and other enterprise applications depending on how credentials are configured and reused.

ReliaQuest Threat Research linked the activity with high confidence to Cl0p, also known as Cl0p or Cl0p ransomware. The vulnerability has been actively exploited and is included in CISA’s Known Exploited Vulnerabilities catalog.

Organizations should therefore assume all secrets accessible to a compromised Windchill instance are exposed and rotate them across downstream systems.

The implant includes vault-enumeration functions that query Windchill’s internal database for file stream identifiers, filenames, storage paths, and sizes.

Cl0p Exploits PTC Windchill Vulnerability

The output is reportedly written to flst.txt, giving attackers a structured inventory of engineering documents and other high-value intellectual property before exfiltration begins.

This capability is particularly concerning for manufacturing organizations, where Windchill commonly centralizes product designs, bills of materials, technical documentation, and development records.

Instead of manually searching filesystems, the attacker can use the application’s own data model to identify the most valuable content at scale.

ReliaQuest also identified a custom Java class loader, named Cldr, that accepts a Base64-encoded ZIP archive containing compiled Java bytecode and executes it directly in memory.

This gives Cl0p ransomware a backdoor for follow-on payloads without modifying the original JSP shell or necessarily writing new files to disk. Potential next-stage activity could include persistence, lateral movement, additional credential theft, or ransomware deployment.

The campaign reflects Cl0p’s established strategy of rapidly exploiting vulnerable enterprise software that stores large volumes of sensitive data.

The group previously used tailored web shells following exploitation of Accellion FTA and MOVEit Transfer vulnerabilities, demonstrating a repeated preference for application-aware implants over commodity shells.

The Windchill shell’s use of tailored classes, database queries, vault logic, and custom header-based command handling suggests it was developed specifically for this campaign.

That specialization makes signature-only controls less effective because malicious behavior is blended into legitimate application workflows.

Organizations using PTC Windchill or FlexPLM should apply PTC’s emergency remediation for CVE-2026-12569 immediately and verify that all affected releases are addressed.

Internet-facing Windchill services should be restricted behind a VPN, trusted access gateway, or web application firewall where operationally feasible.

Security teams should hunt Windchill codebase directories especially /Windchill/login/ for unexpected or recently modified JSP files, with particular attention to files referencing X-windchill-req, MethodContext, WTConnection, or WTKeyStoreUtil.

Investigators should also look for flst.txt, anomalous requests to /Windchill/login/*.jsp, and suspicious large outbound transfers.

Any suspected compromise should trigger immediate server isolation, forensic preservation, removal of confirmed web shells, termination of affected sessions, and rotation of LDAP, administrative, storage, and application credentials.

IOCs

IOCs	Description
321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf	Hash of Clop’s custom webshell
5.180.41[.]35	IP address associated with CVE-2026-12569 exploitation
78.128.113[.]10	IP address associated with CVE-2026-12569 exploitation
104.194.9[.]14	IP address associated with CVE-2026-12569 exploitation
104.243.35[.]63	IP address associated with CVE-2026-12569 exploitation
185.227.83[.]236	IP address associated with CVE-2026-12569 exploitation

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now