Attackers linked to the Cl0p extortion gang are exploiting CVE-2026-12569, a critical unauthenticated remote code execution flaw in PTC Windchill and FlexPLM, to plant JSP webshells on internet-exposed servers and steal engineering and product data. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 25 June 2026 and marked its use in ransomware campaigns as known. Extortion emails are now reaching hundreds of employees inside affected organizations. ReliaQuest notes the actor remains unconfirmed, while the tradecraft matches previous Cl0p campaigns. Here is what to check and fix.
The ransom note no longer arrives with encrypted files. It lands in hundreds of employee inboxes, after the product designs are already gone.
On 24 July 2026 BleepingComputer reported that the Clop extortion gang, also tracked as Cl0p, is targeting internet-exposed PTC Windchill and FlexPLM servers in a new data theft extortion campaign. The attackers exploit CVE-2026-12569, a critical improper input validation flaw that allows remote code execution without authentication on the two product lifecycle management platforms. Security firm ReliaQuest observed active exploitation, rated the flaw CVSS 9.3, and described JSP webshells deployed for remote command execution and exfiltration of sensitive product data. The campaign is fresh, but the vulnerability is not: PTC began shipping patches on 17 June, and CISA added the bug to its Known Exploited Vulnerabilities catalog on 25 June, flagging its use in ransomware campaigns as known. Organizations that patched weeks ago still need to check whether a webshell was planted first.
A patched server is not the same as a clean server
The exploitation window opened before many teams patched. Webshells deployed through CVE-2026-12569 survive the update, so applying the fix does not evict an attacker who is already inside. PTC customers should hunt for the webshells and the published indicators, not just confirm the patch level.
What has been reported
The key findings, from BleepingComputer, The Hacker News and the coordinated advisory they cite:
- ReliaQuest observed active exploitation of CVE-2026-12569 for unauthenticated remote code execution, JSP webshell deployment and product data exfiltration.
- A coordinated advisory by Ransom-ISAC, eCrime.ch and DEFUSED describes a chain: a pre-authentication information disclosure in the FlexPLM WSDL endpoint, rated CVSS 7.5, combined with a flaw in the Windchill login servlet, dropping hex-named JSP webshells under the /Windchill/login/ path.
- Extortion emails are sent from previously compromised accounts to hundreds of users inside each affected organization.
- Targets include the manufacturing, automotive, aerospace and retail sectors, where the two PLM platforms manage product designs from idea to production.
- The actor behind the attacks remains unconfirmed. ReliaQuest notes the tradecraft matches previous Cl0p campaigns against enterprise applications.
The campaign in numbers
The numbers come from the CISA Known Exploited Vulnerabilities entry of 25 June 2026, from the ReliaQuest statements quoted by BleepingComputer and The Hacker News, and from the coordinated Ransom-ISAC advisory. PTC says more than 30,000 customers use its products, including over 1,500 brand and retail customers on FlexPLM, which explains why a single exploitable flaw reaches so far into manufacturing and retail supply chains.
An attribution stated with care
The actor behind these attacks remains unconfirmed. However, the observed tradecraft shares characteristics with previous Cl0p campaigns targeting enterprise applications and high-value data repositories.
How the campaign unfolded
The timeline matters because it separates two different problems: an unpatched server, and a server that was patched after the attackers had already visited. The sequence below follows how a ransomware attack usually unfolds, compressed into five dated steps.
The technique in four figures
Two chained flaws, one short deadline
CISA KEV entry of 25 June 2026; ReliaQuest and Ransom-ISAC data via BleepingComputer and The Hacker News
What the campaign changes for defenders
Each row contrasts a common assumption about PLM platforms with what this campaign actually does, and the practical move a security team can make this week.
| Common assumption | What this campaign does | Defensive move |
|---|---|---|
| PLM is an internal engineering tool | Internet-exposed Windchill and FlexPLM instances are exploited without any authentication | Put PLM behind a VPN or a trusted access gateway, as ReliaQuest advises |
| Applying the patch closes the incident | JSP webshells planted before patching keep working after the update | Hunt for hex-named JSP files under /Windchill/login/ and check the published indicators |
| Extortion arrives with encrypted files | Data is stolen quietly and the pressure arrives later, by email, to hundreds of employees | Prepare an incident response playbook for mass extortion emails, including legal and communications |
What goes wrong if this is treated as just another patch
The failure modes below are the ones this campaign is built to exploit. Each one turns a contained vulnerability into a data breach with regulatory and contractual consequences.
- â›” Confirming the patch level but never hunting for webshells, so the attacker keeps command execution on a fully updated server.
- â›” Forgetting exposed test or legacy PLM instances, which are internet-facing precisely because nobody considers them production.
- â›” Treating the extortion emails as ordinary phishing and deleting them, while the exfiltration that motivated them goes uninvestigated.
- â›” Underestimating what PLM data is: product designs and engineering files from aerospace, automotive and medtech supply chains, exactly the high-value repositories this crew historically targets.
- â›” Restoring service before collecting forensic artifacts and rotating credentials, which destroys the evidence and lets the intruder walk back in.
A script already seen, from Accellion to MOVEit to Oracle EBS
The Clop gang has built its entire model on breaching one widely deployed enterprise platform at a time: Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U, Cleo, and MOVEit Transfer, a campaign that affected more than 2,770 organizations according to Emsisoft figures cited by BleepingComputer. Most recently it exploited an Oracle E-Business Suite zero-day from early August 2025. The US Department of State offers a reward of up to 10 million dollars for information linking the group to a foreign government. Whether or not this Windchill campaign is formally confirmed as Cl0p, the defensive playbook is the same.
What to do this week
Every item below maps to a specific, reported behaviour of this campaign. None requires a new budget line, and the first two remove most of the exposure. For the broader checklist, see our guide on preventing a ransomware attack.
- ✅ Apply the PTC fixes from advisory CS473270 on every Windchill and FlexPLM instance, including test and staging systems. PTC has been shipping patches since 17 June.
- ✅ Remove direct internet exposure: place the platforms behind a VPN or a trusted access gateway, the mitigation ReliaQuest explicitly recommends.
- ✅ Hunt for hex-named JSP webshells under /Windchill/login/ and review web server logs back to mid June, before trusting any instance.
- ✅ Block and hunt for the four indicator IP addresses shared by Ransom-ISAC and PTC: 216.152.148.54, 216.152.151.204, 104.243.35.63 and 5.180.41.35.
- ✅ If compromise is suspected, follow the ReliaQuest sequence: isolate the server, collect forensic artifacts, rotate exposed credentials, and only then restore service.
- ✅ Brief employees that mass extortion emails may arrive from compromised external accounts, and route them to incident response instead of the trash folder.
Exposure is the variable you control
This campaign needed three ingredients: an unpatched flaw, an internet-facing PLM server, and nobody hunting between June and July. Each is fixable this week. If data has already left, treat it as a full incident: forensic preservation first, then legal assessment, then recovery. Our team can help with structured incident response and with recovering encrypted files when extortion escalates that far.
Sources
- BleepingComputer, Clop ransomware targets Windchill, FlexPLM in data theft attacks
- The Hacker News, Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
- CISA, Known Exploited Vulnerabilities catalog, entry CVE-2026-12569
- PTC, security advisory CS473270
- Ransom-ISAC, coordinated advisory on the Windchill and FlexPLM exploitation
Juan Ricardo Palacio
Co-Founder and CEO for the Americas, HelpRansomware
Juan Ricardo Palacio is an electronic engineer, entrepreneur, and specialist in telecommunications, cybersecurity, and digital forensics, with more than 25 years of professional experience. As Co-Founder of HelpRansomware, he works across cyber resilience, ransomware incident response, data recovery, cryptography, and reverse engineering, supporting companies and organizations through high-impact cyber incidents.
📰 Featured and quoted in Forbes Georgia, Business Insider Africa, LA Weekly, and Il Sole 24 Ore.
📅 Last updated: 27 July 2026
