Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

Ravie LakshmananJul 25, 2026Vulnerability / Ransomware

Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign.

"Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling unauthenticated remote code execution and deployment of hex-named JSP web shells under /Windchill/login/," according to a new coordinated advisory released by Ransom-ISAC along with eCrime.ch and DEFUSED.

Upon gaining an initial foothold, the attackers have been found to conduct file system enumeration, stage engineering/design data, and ultimately carry out double extortion data theft. Targets of the campaign include manufacturing, automotive, aerospace, and retail sectors.

It's suspected that threat actors are exploiting CVE-2026-12569 (CVSS score: 9.3), a critical security flaw in PTC Windmill that was added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog late last month.

In an advisory, PTC warned customers that it had "received continued reports of heightened threat activity," adding that unknown attackers are exploiting the vulnerability to deploy JSP web shells against susceptible systems.

"In the observed intrusions, this RCE is chained with a separate pre-authentication information-disclosure defect in the FlexPLM WSDL endpoint (CVSS v3.1 7.5) to enable unauthenticated exploitation," researchers Brandon Parsons, Corsin Camichel, and Simo Kohonen said.

Ransom-ISAC has shared four IP addresses as indicators of compromise (IoCs), all of which match those shared by PTC -

• 216.152.148.54
• 216.152.151.204
• 104.243.35.63
• 5.180.41.35

The extortion emails appear to originate from previously compromised accounts and are sent to hundreds of users within an impacted organization, along with ways to contact the Cl0p ransomware crew.

In a separate post on X, ReliaQuest said it observed threat actors actively exploiting CVE-2026-12569 to facilitate "unauthenticated remote code execution and JSP web shell deployment for remote command execution and sensitive product data exfiltration."

"The actor behind these attacks remains unconfirmed. However, the observed tradecraft shares characteristics with previous Cl0p campaigns targeting enterprise applications and high-value data repositories," it added.

The Cl0p gang has a storied history of going after security flaws in widely-used enterprise products to break into target organizations for data theft and extortion attacks. Previous campaigns mounted by the group have weaponized file transfer appliances, including those from Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer, as well as a vulnerability in Oracle E-Business Suite.

Update

Attack surface management platform Censys said it observed fewer than 100 instances of PTC Windchill exposed to the internet as of June 1, 2026, with a decline in publicly-accessible instances shortly after PTC's advisory on June 17. As of July 20, 2026, there were a little over 80 internet-exposed Windmill instances.

"80% of observed Windchill instances are found in the U.S., and nearly a quarter of hosts running Windchill are on Akamai infrastructure, which aligns with the product's enterprise customer profile," it said.

"Data stolen from these instances may include files like product designs and specs, bills of materials, supplier and vendor data, and other intellectual property. This is particularly concerning given that PTC's customer base includes defense contractors, energy suppliers, medical technology companies, and electronics manufacturers, among others."

(The story was updated after publication on August 3, 2026, to include additional insights from Censys.)

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.