Clop Windchill web shell

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenAug 19, 2026
Last mentionedAug 19, 2026

Timeline

1 articles · newest first

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.

The Hacker NewsAug 19, 15:27 UTC · Aug 19, 2026Threat actorExploitedCVE-2026-125692

Related CVEs

by mentions

CVE-2026-1256946%9.3
Unauthenticated RCE in PTC Windchill and FlexPLM
published Jun 18, 2026PTC WindchillKEVRansomware

Appears with

eCrime.chorganization · 1
Clopthreat actor · 1
Ransom-ISACorganization · 1
Defusedorganization · 1
FlexPLMproduct · 1
The Hacker Newsorganization · 1
PTC Windchillproduct · 1
ReliaQuestorganization · 1
PTCvendor · 1

Entities are extracted by the model from each article. First seen Aug 19, 2026, last mentioned Aug 19, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.