Cl0p Targets 40+ Organizations Through PTC Windchill Flaw
Cl0p claims over 40 organizations including Shell and Philips were breached by exploiting critical RCE CVE-2026-12569 in PTC Windchill and FlexPLM.
Cl0p claims more than 40 organizations were victimized via CVE-2026-12569 (CVSS 9.3), a critical deserialization-based remote code execution flaw in PTC Windchill PDMlink and FlexPLM, affecting releases prior to 11.0 M030; CISA added the flaw to its KEV catalog in June. ReliaQuest found the group deployed a custom web shell that maps vault data, decrypts all credentials in the Windchill keystore, and includes a Java class loader enabling arbitrary code execution, lateral movement, persistence, and large-scale data exfiltration without extra tooling. Named victims include Shell, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, Toast, Mindray, and Apple lens supplier Largan Precision, with stolen data ranging from one gigabyte to multiple terabytes per target. The campaign mirrors Cl0p's earlier mass-exploitation extortion operations against MOVEit, Cleo, GoAnywhere, and Oracle E-Business Suite.
- Cl0p exploited CVE-2026-12569 (CVSS 9.3), a deserialization RCE in Windchill PDMlink and FlexPLM, added to CISA KEV in June.
- ReliaQuest identified a custom web shell that decrypts keystore credentials and loads arbitrary Java classes, acting as a full backdoor.
- Victims include Shell, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, Toast, Mindray, and Largan Precision; GE was briefly listed.
- Stolen data spans databases, blueprints, backups, and engineering files, ranging from one gigabyte to multiple terabytes per victim.
- Organizations running Windchill or FlexPLM should verify patch status and hunt for indicators of this campaign.
- CVEs
- CVE-2026-12569
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1555 Credentials from Password StoresT1041 Exfiltration Over C2 Channel
- Vendors
- PTC
- Products
- Windchill PDMlinkFlexPLM
- Threat actors
- Cl0p
- Organizations
- CISAReliaQuest
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-12569 | Unauthenticated RCE in PTC Windchill and FlexPLM | 9.3 | 46% | KEVRansomware | KEV |
From the original article
3 min read at securityaffairs.com
Cl0p claims over 40 organizations fell victim to attacks exploiting a PTC Windchill and FlexPLM vulnerability. Cl0p is using a familiar strategy again: exploit one flaw in enterprise software to attack many companies, then publish the victims’ names if they refuse to pay.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.