Cl0p Ransomware Affiliates Target PTC Windchill and FlexPLM in Global Data-Theft Campaign
In a troubling new development in cybersecurity, affiliates of the Cl0p ransomware group are actively exploiting vulnerabilities found in PTC Windchill and FlexPLM deployments worldwide. This exploitation is part of a coordinated data-theft campaign aimed at high-value engineering environments, raising significant concerns for an array of industries.
The method of exploitation reveals a disturbing trend in cybersecurity threats. Following an initial breach, Cl0p affiliates are reported to perform filesystem enumeration using files named “flst.txt.” This technique allows them to identify and stage sensitive engineering and product design data for exfiltration, significantly endangering the intellectual property of impacted organizations. This sequence of actions empowers the attackers, enabling unauthenticated remote code execution, which allows them to deploy malicious JSP webshells within the directory “/Windchill/login/.” Such capabilities present a severe risk to the operational integrity of compromised companies.
Industries particularly affected by this sophisticated campaign include Manufacturing, Automotive, Aerospace, and Retail/Apparel sectors, where Windchill is a critical component for product lifecycle management. The exploitation centers around a critical vulnerability identified as CVE-2026-12569—a deserialization flaw that carries a daunting CVSS score of 9.8. This serious vulnerability affects Windchill PDMLink and FlexPLM, and it was disclosed on June 17, 2026. Just a week later, on June 25, it was added to the Cybersecurity and Infrastructure Security Agency (CISA)’s catalog of Known Exploited Vulnerabilities, highlighting the urgency for organizations to take immediate action.
Investigations into the situation reveal that the Cl0p ransomware group had apparently weaponized this vulnerability as a zero-day exploit earlier that month. They combined it with a different FlexPLM WSDL disclosure vulnerability, rated at CVSS 7.5, to create a more reliable method for exploiting internet-facing systems. For businesses using these technologies, this means an increased likelihood of falling victim to data breaches if they do not take necessary precautions and deploy updates promptly.
Technical details about the vulnerabilities and remediation recommendations are available through the National Vulnerability Database (NVD) entry for CVE-2026-12569 and the official advisory from PTC. Companies are encouraged to take these advisories seriously to safeguard their data effectively.
Threat telemetry associated with this campaign has provided security researchers with distinct indicators, including a malicious HTTP header labeled “X-windchill-req: ?x8Fmgow,” as well as reconnaissance patterns showing GET requests to paths such as “/Windchill/rfa/jsp/login/*.jsp,” which return specific response sizes indicative of exploitation attempts. Organizations should conduct webshell detection focusing on specific paths that match “/Windchill/login/[0-9a-f]{16}.jsp” in conjunction with known harmful file hashes, like SHA-256 “55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c.”
In addition to the exploitation efforts, Cl0p has initiated a well-coordinated extortion campaign. Starting on July 20, researchers observed a surge in mass emails targeting employees within affected organizations. These emails bore alarming subjects such as “Windchill PDMLink module serious data leak,” and were sent from compromised accounts, further muddying the waters of trust. The emails assert that Windchill systems have been breached, providing direct victims with new communication channels linked to the Cl0p group.
The methods employed in this campaign appear to echo the group’s prior extortions, such as those targeting the Oracle E-Business Suite, yet with notable differences in infrastructure and messaging to enhance the pressure on victims and give an impression of legitimacy. Despite the aggressive network activity, as of July 22, Cl0p has refrained from publicly listing confirmed victims on its data leak site. This absence might reflect the group’s history of delaying disclosures while negotiating extortion terms, which adds an unsettling dimension of uncertainty for affected organizations.
Given Cl0p’s operational maturity and a demonstrated history of extensive data extortion campaigns, this current activity represents a significant risk not just to individual organizations, but also to the broader supply chain and intellectual property integrity across multiple sectors.
To counteract these threats, PTC has released patched versions addressing both the remote code execution and WSDL disclosure issues. However, organizations with unpatched and internet-exposed instances remain at a heightened level of risk. As such, companies are strongly urged to review PTC’s security advisory and remediation steps. Proactive measures should include retrospective threat hunting extending back to early June 2026 and continuous monitoring as this evolving campaign continues to unfold with potential victim disclosures high on the horizon.
Indicators of Compromise:
- 216.152.148.54
- 216.152.151.204
- 104.243.35.63
- 5.180.41.35
(Note: IP addresses and domains have been defanged to prevent accidental resolution.)