Loading story…
Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill PDMLink and FlexPLM servers to steal engineering, product-design, and other intellectual-property data from victim organizations. The intrusion chain combines a pre-authentication information disclosure in the FlexPLM WSDL endpoint with CVE-2026-12569, a critical deserialization-based remote code execution flaw affecting vulnerable Windchill and FlexPLM releases before 11.0 M030, allowing unauthenticated compromise. Reporting from Ransom-ISAC, eCrime.ch, and DEFUSED indicates the activity likely began as a zero-day campaign in early June and primarily threatens manufacturers, automotive firms, aerospace organizations, and retail/apparel companies that store sensitive product-development records on these platforms.
After gaining access, the attackers reportedly deploy hex-named JSP webshells under the Windchill login path, enumerate files including use of flst.txt, and stage data for theft before launching double-extortion pressure campaigns. Extortion emails observed from July 20 carried the subject line "Windchill PDMLink module serious data leak" and were sent from randomly compromised accounts to large numbers of internal users at affected organizations, increasing pressure before public naming. CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities catalog, while security groups warned that unpatched, internet-facing Windchill and FlexPLM deployments remain the main exposure point.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
On August 18, 2026, ReliaQuest released additional detection details from its CVE-2026-12569 investigation, including the SHA256 hash of the custom JSP web shell and seven IP addresses tied to exploitation activity. The report supported high-confidence Cl0p attribution and provided defenders with concrete indicators for SOC and CTI detection.
Ransom-ISAC, eCrime.ch, and DEFUSED said Cl0p affiliates likely started exploiting CVE-2026-12569 as a zero-day in early June 2026 against internet-exposed PTC Windchill and FlexPLM systems. The intrusions used a pre-authentication information disclosure and the deserialization/RCE flaw to gain unauthenticated access, deploy JSP webshells, and steal engineering and design data.
A coordinated advisory from Ransom-ISAC, eCrime.ch, and DEFUSED disclosed active Cl0p affiliate exploitation of exposed PTC Windchill and FlexPLM systems, along with details on the intrusion chain, webshell deployment, and data-theft extortion activity. The advisory also noted that PTC had released fixed builds.
On July 20, 2026, attackers began sending mass extortion emails tied to the campaign, including messages with the subject line "Windchill PDMLink module serious data leak." The emails were sent from randomly compromised accounts to large numbers of users inside affected organizations.
CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities catalog on June 25, 2026, reflecting active exploitation risk for unpatched internet-facing PTC Windchill and FlexPLM deployments.
PTC released fixes for CVE-2026-12569 in Windchill and FlexPLM on June 17, 2026. The company published indicators of compromise the following day to help defenders identify exploitation activity.
ReliaQuest analyzed a JavaServer Pages web shell used in CVE-2026-12569 intrusions and concluded it was purpose-built for PTC Windchill and FlexPLM, with functions to decrypt secrets, enumerate file vaults, read and delete files, and load Java payloads in memory. The report linked the implant to Cl0p through extortion-email overlap, the custom X-windchill-req header, and tradecraft consistent with prior Cl0p campaigns.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
15 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecyberaccord.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcethreats.wiz.io
Open sourceransom-isac.org
Open sourceptc.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Shell said it is investigating a potential security incident after the **Clop** extortion group claimed it stole **89 GB** of company data, including engineering drawings, facility photos, project plans, and scans of facility testing reports. Separate victim-listing reports also named **GE** and **Philips** as compromised organizations, indicating a broader campaign affecting major firms in the energy, technology, and healthcare sectors. The activity has been tied to Clop’s exploitation of Internet-exposed **PTC Windchill** and **FlexPLM** systems through **`CVE-2026-12569`**, an actively exploited vulnerability for which PTC began issuing patches on June 17. Security reporting said the attackers deployed **JSP webshells** to steal data from compromised product lifecycle management platforms, while **CISA** and Germany’s **BSI** warned organizations to urgently secure exposed instances as confirmed exploitation spread beyond Shell to other high-profile enterprises.
Aug 21, 2026
PTC disclosed **CVE-2026-4681**, a critical deserialization flaw in **Windchill PDMLink** and **FlexPLM** that can allow **remote code execution**. The vulnerability affects multiple major release branches, including **11.x, 12.x, and 13.x**, with impacted builds including CPS releases before **11.0 M030**. PTC rated the issue **CVSS v3.1 10.0** and **CVSS v4 9.3**, and said the risk is highest for **publicly accessible instances**. PTC said it has **no evidence of active exploitation affecting customers** at this time, but issued urgent mitigation guidance while patches are pending. The company advised administrators to apply protections in **Apache HTTP Server** and **Microsoft IIS**, extend the same controls to **File Server** and **Replica Server** deployments, and disconnect exposed systems or shut services down if mitigations cannot be applied. PTC also published **indicators of compromise**, including suspicious HTTP request patterns, a specific Chrome user-agent string, malicious filenames, a `payload.bin` SHA-256 hash, and related log messages; for **PTC cloud-hosted** customers, the Apache workaround has already been deployed.
Jun 30, 2026
PTC Windchill PDMLink and FlexPLM are facing active exploitation of **`CVE-2026-4681`**, a critical remote code execution flaw caused by deserialization of untrusted data. Splunk published detection guidance describing suspicious HTTP patterns tied to exploitation, including requests containing `run?c=`, `run?p=`, `.jsp?c=`, and `.jsp?p=`, as well as the indicator `GW_READY_OK`. The activity suggests attackers may deploy staged gateway or JSP components, use the `c=` parameter to run operating system commands such as `whoami`, and abuse the `p=` parameter to read files from affected servers. Defenders are being urged to apply PTC’s mitigation and patching guidance and to hunt for related artifacts across compromised environments. Splunk recommends monitoring Windchill MethodServer `log4j` telemetry, particularly servlet-related loggers, and checking file systems for indicators such as `GW.class`, `payload.bin`, and randomly named `dpr_<8 hex>.jsp` files. A Siemens product advisory was also referenced in the reporting set, indicating broader vendor awareness around the issue and the need for rapid validation of exposure in enterprise environments.
Jun 29, 2026