The long tail of Clop’s PTC hack is just beginning to emerge
Clop mass-exploited CVE-2026-12569 in PTC Windchill and FlexPLM in early June, claiming data theft from dozens of large organizations.
Clop began sending extortion emails in mid-July after exploiting CVE-2026-12569 in PTC Windchill and FlexPLM, likely as a zero-day in early June before PTC's June 17 disclosure and patch. Confirmed victims include Toast and Zebra, while GE, Philips and Shell are among claimed victims. CISA added the flaw, which allows unauthenticated remote code execution, to its KEV catalog on June 25. ReliaQuest said the group used a custom Windchill-specific web shell for credential theft and large-scale exfiltration, echoing its past MOVEit and Oracle E-Business Suite mass-exploitation campaigns.
- Zero-day exploitation likely began in early June, before PTC's June 17 patch
- Toast and Zebra confirmed intrusions, reporting limited impact
- CISA added CVE-2026-12569 to the KEV catalog on June 25
- Custom Windchill web shell enabled credential theft and large-scale data exfiltration
- Campaign mirrors Clop's MOVEit and Oracle E-Business Suite operations
- CVEs
- CVE-2026-12569
- Vendors
- PTC
- Threat actors
- Clop
- Organizations
- CISAReliaQuestRansom-ISACRecorded FutureCyberScoop
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-12569 | Unauthenticated RCE in PTC Windchill and FlexPLM | 9.3 | 46% | KEVRansomware | KEV |
From the original article
4 min read at cyberscoop.com
The data theft extortion group likely compromised a critical vulnerability affecting PTC’s product lifecycle management software in June, a month before it sent threatening emails to victims. A notorious cybercrime group has once again exploited a critical zero-day vulnerability on a large scale, claiming it stole data from dozens of organizations, including some of the world’s largest publicly traded companies.
By @CyberScoopNews · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.