Loading story…
Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill PDMLink and FlexPLM servers to steal engineering, product-design, and other intellectual-property data from victim organizations. The intrusion chain combines a pre-authentication information disclosure in the FlexPLM WSDL endpoint with CVE-2026-12569, a critical deserialization-based remote code execution flaw affecting vulnerable Windchill and FlexPLM releases before 11.0 M030, allowing unauthenticated compromise. Reporting from Ransom-ISAC, eCrime.ch, and DEFUSED indicates the activity likely began as a zero-day campaign in early June and primarily threatens manufacturers, automotive firms, aerospace organizations, and retail/apparel companies that store sensitive product-development records on these platforms.
After gaining access, the attackers reportedly deploy hex-named JSP webshells under the Windchill login path, enumerate files including use of flst.txt, and stage data for theft before launching double-extortion pressure campaigns. Extortion emails observed from July 20 carried the subject line "Windchill PDMLink module serious data leak" and were sent from randomly compromised accounts to large numbers of internal users at affected organizations, increasing pressure before public naming. CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities catalog, while security groups warned that unpatched, internet-facing Windchill and FlexPLM deployments remain the main exposure point.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Ransom-ISAC, eCrime.ch, and DEFUSED said Cl0p affiliates likely started exploiting CVE-2026-12569 as a zero-day in early June 2026 against internet-exposed PTC Windchill and FlexPLM systems. The intrusions used a pre-authentication information disclosure and the deserialization/RCE flaw to gain unauthenticated access, deploy JSP webshells, and steal engineering and design data.
A coordinated advisory from Ransom-ISAC, eCrime.ch, and DEFUSED disclosed active Cl0p affiliate exploitation of exposed PTC Windchill and FlexPLM systems, along with details on the intrusion chain, webshell deployment, and data-theft extortion activity. The advisory also noted that PTC had released fixed builds.
On July 20, 2026, attackers began sending mass extortion emails tied to the campaign, including messages with the subject line "Windchill PDMLink module serious data leak." The emails were sent from randomly compromised accounts to large numbers of users inside affected organizations.
CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities catalog on June 25, 2026, reflecting active exploitation risk for unpatched internet-facing PTC Windchill and FlexPLM deployments.
PTC released fixes for CVE-2026-12569 in Windchill and FlexPLM on June 17, 2026. The company published indicators of compromise the following day to help defenders identify exploitation activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
censys.com
Open sourcethreataft.com
Open sourcesecurityweek.com
Open sourcethreataft.com
Open sourcecybersecuritynews.com
Open sourcethreats.wiz.io
Open sourceransom-isac.org
Open sourceptc.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Shell said it is investigating a potential security incident after the **Clop** extortion group claimed it stole **89 GB** of company data, including engineering drawings, facility photos, project plans, and scans of facility testing reports. Separate victim-listing reports also named **GE** and **Philips** as compromised organizations, indicating a broader campaign affecting major firms in the energy, technology, and healthcare sectors. The activity has been tied to Clop’s exploitation of Internet-exposed **PTC Windchill** and **FlexPLM** systems through **`CVE-2026-12569`**, an actively exploited vulnerability for which PTC began issuing patches on June 17. Security reporting said the attackers deployed **JSP webshells** to steal data from compromised product lifecycle management platforms, while **CISA** and Germany’s **BSI** warned organizations to urgently secure exposed instances as confirmed exploitation spread beyond Shell to other high-profile enterprises.
Aug 15, 2026
PTC disclosed **CVE-2026-4681**, a critical deserialization flaw in **Windchill PDMLink** and **FlexPLM** that can allow **remote code execution**. The vulnerability affects multiple major release branches, including **11.x, 12.x, and 13.x**, with impacted builds including CPS releases before **11.0 M030**. PTC rated the issue **CVSS v3.1 10.0** and **CVSS v4 9.3**, and said the risk is highest for **publicly accessible instances**. PTC said it has **no evidence of active exploitation affecting customers** at this time, but issued urgent mitigation guidance while patches are pending. The company advised administrators to apply protections in **Apache HTTP Server** and **Microsoft IIS**, extend the same controls to **File Server** and **Replica Server** deployments, and disconnect exposed systems or shut services down if mitigations cannot be applied. PTC also published **indicators of compromise**, including suspicious HTTP request patterns, a specific Chrome user-agent string, malicious filenames, a `payload.bin` SHA-256 hash, and related log messages; for **PTC cloud-hosted** customers, the Apache workaround has already been deployed.
Jun 30, 2026
PTC Windchill PDMLink and FlexPLM are facing active exploitation of **`CVE-2026-4681`**, a critical remote code execution flaw caused by deserialization of untrusted data. Splunk published detection guidance describing suspicious HTTP patterns tied to exploitation, including requests containing `run?c=`, `run?p=`, `.jsp?c=`, and `.jsp?p=`, as well as the indicator `GW_READY_OK`. The activity suggests attackers may deploy staged gateway or JSP components, use the `c=` parameter to run operating system commands such as `whoami`, and abuse the `p=` parameter to read files from affected servers. Defenders are being urged to apply PTC’s mitigation and patching guidance and to hunt for related artifacts across compromised environments. Splunk recommends monitoring Windchill MethodServer `log4j` telemetry, particularly servlet-related loggers, and checking file systems for indicators such as `GW.class`, `payload.bin`, and randomly named `dpr_<8 hex>.jsp` files. A Siemens product advisory was also referenced in the reporting set, indicating broader vendor awareness around the issue and the need for rapid validation of exposure in enterprise environments.
Jun 29, 2026