Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a global data-theft campaign targeting high-value engineering environments.
Observed post-exploitation activity includes filesystem enumeration via files such as “flst.txt,” followed by staging and exfiltration of sensitive engineering and product design data.
This chaining enables unauthenticated remote code execution, allowing attackers to deploy hex-named JSP webshells within the path “/Windchill/login/”.
Impacted sectors include Manufacturing, Automotive, Aerospace, and Retail/Apparel industries where Windchill is widely deployed for product lifecycle management.
At the center of the exploitation is CVE-2026-12569, a critical deserialization flaw (CVSS 9.8) affecting Windchill PDMLink and FlexPLM.
The vulnerability, disclosed on June 17, 2026, enables remote code execution without authentication and was added to CISA’s Known Exploited Vulnerabilities catalog on June 25, 2026.
Evidence suggests Cl0p affiliates weaponized this flaw as a zero-day earlier in June, chaining it with a separate FlexPLM WSDL disclosure vulnerability (CVSS 7.5) to achieve reliable exploitation against internet-facing systems.
Technical details and remediation guidance are available via the NVD entry for CVE-2026-12569 and PTC’s official advisory.
Threat telemetry highlights distinct indicators associated with this campaign, including the malicious HTTP header “X-windchill-req: ?x8Fmgow” and reconnaissance patterns such as GET requests to “/Windchill/rfa/jsp/login/*.jsp?wsdl” returning response sizes of 4045 bytes.
Webshell hunting should focus on paths matching “/Windchill/login/[0-9a-f]{16}.jsp,” alongside known file hashes such as SHA-256 “55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c.”
Newly identified command-and-control infrastructure includes IPs 216.152.148.54, 216.152.151.204, 104.243.35.63, and 5.180.41.35, the latter flagged for priority blocking.
Ransom-ISAC Researchers said that, the campaign leverages a multi-stage exploit chain combining a pre-authentication information disclosure flaw in the FlexPLM WSDL endpoint with a server-side vulnerability in the Windchill login servlet.
Parallel to exploitation, Cl0p has initiated a coordinated extortion campaign. Since July 20, security researchers observed mass email distribution with the subject “Windchill PDMLink module serious data leak,” sent from compromised accounts to large numbers of employees within targeted organizations.
Cl0p Targets Internet-Exposed Windchill
The emails assert that Windchill systems have been breached and direct victims to newly established Cl0p contact channels.
This tactic mirrors the group’s prior Oracle E-Business Suite extortion operations but introduces updated infrastructure and messaging to increase pressure and legitimacy.
Despite the scale of activity, as of July 22, Cl0p has not publicly listed confirmed victims on its data leak site.
However, the absence of public disclosures aligns with the group’s historical pattern of delaying publication while negotiating extortion demands.
Given the operational maturity of Cl0p and its history of large-scale data extortion campaigns, this activity represents a significant risk to intellectual property and supply chain integrity.
PTC has released patched versions addressing both the RCE and WSDL disclosure issues, but unpatched and internet-exposed instances remain highly susceptible.
Organizations are strongly advised to review PTC’s security advisory and remediation steps, conduct retrospective threat hunting dating back to early June 2026.
Ongoing monitoring is recommended as the campaign evolves and potential victim disclosures emerge.
Indicators of Compromise
216.152.148.54216.152.151.204104.243.35.635.180.41.35
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist
