Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.
ReliaQuest analyzed a custom Java web shell planted on vulnerable PTC Windchill and FlexPLM servers following exploitation of CVE-2026-12569 (CVSS 9.3). The implant decrypts Windchill keystore credentials including the LDAP manager password, enumerates the file vault for engineering data, and loads attacker-supplied Java classes in memory for post-exploitation. Commands let operators read and delete files, exfiltrate results, and deliver follow-on payloads such as ransomware. Ransom-ISAC, eCrime.ch and Defused previously attributed the campaign to the Clop data-theft extortion group.
- Bespoke JSP web shell targets PTC Windchill and FlexPLM instances
- Decrypts all Windchill keystore credentials, including LDAP manager password
- 'S' command exposes directory credentials that could enable enterprise-wide compromise
- In-memory Java class loader delivers follow-on payloads like ransomware
- Implant mimics Windchill's own traffic to evade signature-based detection
- CVEs
- CVE-2026-12569
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1555 Credentials from Password StoresT1620 Reflective Code Loading
- Vendors
- PTC
- Products
- PTC WindchillFlexPLM
- Threat actors
- Clop
- Malware
- Clop Windchill web shell
- Organizations
- ReliaQuestRansom-ISACeCrime.chDefusedThe Hacker News
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-12569 | Unauthenticated RCE in PTC Windchill and FlexPLM | 9.3 | 46% | KEVRansomware | KEV |
From the original article
4 min read at thehackernews.com
A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management (PLM) software, according to new findings from ReliaQuest.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.