Loading story…
Shell said it is investigating a potential security incident after the Clop extortion group claimed it stole 89 GB of company data, including engineering drawings, facility photos, project plans, and scans of facility testing reports. Separate victim-listing reports also named GE and Philips as compromised organizations, indicating a broader campaign affecting major firms in the energy, technology, and healthcare sectors.
The activity has been tied to Clop’s exploitation of Internet-exposed PTC Windchill and FlexPLM systems through CVE-2026-12569, an actively exploited vulnerability for which PTC began issuing patches on June 17. Security reporting said the attackers deployed JSP webshells to steal data from compromised product lifecycle management platforms, while CISA and Germany’s BSI warned organizations to urgently secure exposed instances as confirmed exploitation spread beyond Shell to other high-profile enterprises.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Clop was reported as targeting SHELL.COM and exfiltrating 89 GB of data, including engineering drawings, facility photos, scans of testing reports, and project plans. The breach was listed at 15:25 UTC and discovery at 15:26 UTC.
Clop was reported as breaching PHILIPS.COM in a data-breach incident affecting Philips. The breach and discovery were both listed at 15:28 UTC.
Clop was reported as breaching GE.COM in a data-theft incident affecting General Electric. The breach time was listed as 15:26 UTC, with discovery one minute later at 15:27 UTC.
PTC warned customers about heightened threat activity involving CVE-2026-12569 affecting Internet-exposed Windchill and FlexPLM instances.
PTC started releasing security patches for the critical PTC Windchill and FlexPLM vulnerability CVE-2026-12569. The company also issued a private advisory urging customers to review their environments for indicators of compromise.
Shell said it was aware of a potential security incident after Clop listed the company on its leak site and claimed to have stolen 89 GB of data. A spokesperson said the company was working with security teams and relevant experts to investigate.
CISA confirmed that CVE-2026-12569 was being actively exploited in attacks, added it to the Known Exploited Vulnerabilities catalog, and ordered U.S. federal agencies to secure vulnerable PTC instances within three days. Germany's BSI also warned customers to patch affected systems quickly.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cl0p ransomware affiliates are actively exploiting internet-exposed **PTC Windchill PDMLink** and **FlexPLM** servers to steal engineering, product-design, and other intellectual-property data from victim organizations. The intrusion chain combines a pre-authentication information disclosure in the FlexPLM WSDL endpoint with **`CVE-2026-12569`**, a critical deserialization-based remote code execution flaw affecting vulnerable Windchill and FlexPLM releases before **11.0 M030**, allowing unauthenticated compromise. Reporting from Ransom-ISAC, eCrime.ch, and DEFUSED indicates the activity likely began as a zero-day campaign in early June and primarily threatens manufacturers, automotive firms, aerospace organizations, and retail/apparel companies that store sensitive product-development records on these platforms. After gaining access, the attackers reportedly deploy hex-named **JSP webshells** under the Windchill login path, enumerate files including use of **`flst.txt`**, and stage data for theft before launching double-extortion pressure campaigns. Extortion emails observed from July 20 carried the subject line **"Windchill PDMLink module serious data leak"** and were sent from randomly compromised accounts to large numbers of internal users at affected organizations, increasing pressure before public naming. **CISA** added **`CVE-2026-12569`** to its Known Exploited Vulnerabilities catalog, while security groups warned that unpatched, internet-facing Windchill and FlexPLM deployments remain the main exposure point.
Jul 30, 2026
The **Clop** ransomware operation has repeatedly targeted enterprise networks with intrusions that begin with phishing or exploitation of exposed systems, followed by manual lateral movement, credential theft, and domain-wide deployment. Reporting from ANSSI and AhnLab linked earlier campaigns to **TA505**, describing attacks in which operators used tools such as **Cobalt Strike** and **Mimikatz**, encrypted files with `.Clop` or `.CIop` extensions, and disrupted business operations at victims including **E-Land Group**, **Software AG**, and reportedly **Indiabulls Group**. Analysts also observed Clop using signed malware components, targeting Active Directory environments, stopping business-critical services before encryption, and in some cases preserving shadow copies depending on the variant. The group increasingly shifted from encryption-only attacks to **double extortion** and broader data-leak pressure tactics. Clop operators published stolen files on leak sites, demanded multimillion-dollar payments, contacted victims' customers directly to intensify pressure, and were tied to mass data-theft campaigns exploiting managed file transfer flaws such as **`CVE-2023-0669`** in **Fortra GoAnywhere MFT**, which was linked to theft from about 130 companies. More recent victim listings attributed to Clop include organizations in the **U.S., Canada, Peru, China, Taiwan, and Europe** across technology, manufacturing, retail, and other sectors, underscoring the group's continued global focus on enterprise-scale ransomware and data-breach operations.
Aug 15, 2026
The Cl0p extortion group exploited multiple critical SQL injection flaws in Progress Software's MOVEit Transfer platform, beginning with the zero-day later tracked as `CVE-2023-34362`, to breach organizations worldwide and steal large volumes of data. Researchers and government agencies linked the campaign to Cl0p, also tracked as Lace Tempest, `FIN11`, and `TA505`, and reported that attackers often deployed the **LemurLoot** web shell and exfiltrated files within minutes; in some cases, the malware could also pull Azure Blob storage details and credentials from MOVEit settings. Progress disclosed and patched additional MOVEit vulnerabilities, including `CVE-2023-35036` and `CVE-2023-35708`, as incident responders warned that victim counts would continue to rise through delayed breach notifications and downstream third-party exposure. The fallout spread across government, finance, healthcare, education, insurance, professional services, and major global brands, with disclosures naming entities such as EY, PwC, Sony and Pan-American Life Insurance Group among the affected organizations or reported victims. By later tallies, the campaign had compromised thousands of organizations and tens of millions of individuals, while Cl0p shifted from encryption to **data-theft and extortion**, publishing stolen information from nonpaying victims on leak sites. The incident triggered broad regulatory scrutiny, lawsuits, response costs, and supply-chain consequences as organizations discovered that exposure often came through vendors and file-transfer partners rather than direct compromise.
Aug 15, 2026