CL0P's Ransomware Rampage
60
60
60
60
Cl0p Targets 40+ Organizations Through PTC Windchill Flaw
Cl0p claims over 40 organizations including Shell and Philips were breached by exploiting critical RCE CVE-2026-12569 in PTC Windchill and FlexPLM.
Cl0p claims more than 40 organizations were victimized via CVE-2026-12569 (CVSS 9.3), a critical deserialization-based remote code execution flaw in PTC Windchill PDMlink and FlexPLM, affecting releases prior to 11.0 M030; CISA added the flaw to its KEV catalog in June. ReliaQuest found the group deployed a custom web shell that maps vault data, decrypts all credentials in the Windchill keystore, and includes a Java class loader enabling arbitrary code execution, lateral movement, persistence, and large-scale data exfiltration without extra tooling. Named victims include Shell, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, Toast, Mindray, and Apple lens supplier Largan Precision, with stolen data ranging from one gigabyte to multiple terabytes per target. The campaign mirrors Cl0p's earlier mass-exploitation extortion operations against MOVEit, Cleo, GoAnywhere, and Oracle E-Business Suite.
88
60
60
60
60
60
60
60
Harley-Davidson Alleged Breach – CL0P Ransomware Adds Motorcycle Maker to the List
CL0P ransomware group listed Harley-Davidson on its extortion leak site, claiming a compromise; the motorcycle maker has not confirmed any breach.
The CL0P ransomware operation added Harley-Davidson to its public extortion portal, a listing highlighted by the ransomNews monitoring account on September 10, 2026. Harley-Davidson has not confirmed any compromise, and the initial access method, affected business unit, timing, and volume of stolen data remain unknown, with no sample files or technical indicators published. The article stresses that leak-site listings alone do not confirm a breach and can serve as negotiation pressure in double-extortion schemes. If verified, stolen data could fuel downstream phishing, BEC, credential-stuffing, and invoice fraud targeting dealers, suppliers, and customers.
60
60
60
60
60
60
October 2025 CVE Landscape
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60