Cl0p Ransomware Exploits PTC Windchill Servers in Targeted Data Theft Campaign
Cl0p ransomware affiliates are actively exploiting unpatched PTC Windchill and FlexPLM servers to steal sensitive engineering and product-design data from manufacturers, automotive firms, aerospace organizations, and retail apparel companies. The campaign, identified by Ransom-ISAC in collaboration with eCrime.ch and DEFUSED, leverages critical vulnerabilities to gain unauthorized access, exfiltrate intellectual property, and pressure victims through double-extortion tactics.
Attack Method & Vulnerabilities
The intrusion begins with the exploitation of two flaws:
- CVE-2026-12569 (CVSS 9.8) – A critical deserialization vulnerability in PTC Windchill PDMLink and FlexPLM versions before 11.0 M030, disclosed on June 17 and added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on June 25.
- A pre-authentication information disclosure in the FlexPLM WSDL endpoint, chained with a Windchill login servlet weakness to enable remote code execution (RCE) without credentials.
Once inside, attackers deploy JSP webshells, inspect server files, and stage engineering data for theft bypassing traditional phishing or malware delivery methods.
Extortion & Impact
Following initial access (dating back to early June), Cl0p operators send mass extortion emails to employees, using compromised accounts to amplify pressure. The emails, observed from July 20, warn of a "Windchill PDMLink module serious data leak", forcing organizations to investigate while exposing staff to follow-on phishing attempts.
The breach poses severe risks, as Windchill systems often store unreleased product designs, specifications, and development workflows data that, if leaked, could benefit competitors or criminal buyers. The double-extortion model ensures leverage even if victims restore from backups.
Indicators of Compromise (IoCs)
Security teams are advised to monitor for:
- C2 IP addresses:
216.152.148.54,216.152.151.204,104.243.35.63,5.180.41.35 - Malicious JSP webshells:
Windchill/login/[0-9a-f]{16}.jsp - Reconnaissance requests:
GET /Windchill/rfa/jsp/login.jsp?wsdl(response size: 40,454 bytes) - File artifacts:
flst.txt(file listing)
Mitigation & Response
Organizations should:
- Patch vulnerable Windchill/FlexPLM servers immediately.
- Hunt for compromise dating back to early June using published IoCs.
- Review access logs for unusual outbound activity and unexpected JSP files.
- Preserve extortion emails for forensic analysis.
The campaign underscores the risks of unauthenticated RCE flaws in business-critical systems, where delayed patching can lead to rapid data theft and extortion.
Source: https://cybersecuritynews.com/cl0p-hackers-exploit-windchill/
Windchill, a PTC Technology cybersecurity rating report: https://www.rankiteo.com/company/ptc-windchill
Ransom-ISAC cybersecurity rating report: https://www.rankiteo.com/company/ransom-isac
"id": "PTCRAN1784903272",
"linkid": "ptc-windchill, ransom-isac",
"type": "Ransomware",
"date": "6/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': ['Manufacturing',
'Automotive',
'Aerospace',
'Retail Apparel'],
'type': ['Manufacturers',
'Automotive firms',
'Aerospace organizations',
'Retail apparel companies']}],
'attack_vector': 'Exploitation of unpatched vulnerabilities (CVE-2026-12569, '
'FlexPLM WSDL endpoint, Windchill login servlet weakness)',
'data_breach': {'data_exfiltration': True,
'sensitivity_of_data': 'High (unreleased product designs, '
'specifications, development '
'workflows)',
'type_of_data_compromised': ['Engineering data',
'Product-design data',
'Intellectual property']},
'date_detected': '2024-06-01',
'date_publicly_disclosed': '2024-06-25',
'description': 'Cl0p ransomware affiliates are actively exploiting unpatched '
'PTC Windchill and FlexPLM servers to steal sensitive '
'engineering and product-design data from manufacturers, '
'automotive firms, aerospace organizations, and retail apparel '
'companies. The campaign leverages critical vulnerabilities to '
'gain unauthorized access, exfiltrate intellectual property, '
'and pressure victims through double-extortion tactics.',
'impact': {'brand_reputation_impact': 'Severe risk due to exposure of '
'intellectual property and competitive '
'data',
'data_compromised': 'Sensitive engineering and product-design '
'data, unreleased product designs, '
'specifications, development workflows',
'operational_impact': 'Potential disruption due to data theft and '
'extortion pressure',
'systems_affected': 'PTC Windchill PDMLink, FlexPLM servers'},
'initial_access_broker': {'backdoors_established': 'JSP webshells',
'entry_point': 'Exploitation of unpatched PTC '
'Windchill/FlexPLM vulnerabilities',
'high_value_targets': 'Engineering and '
'product-design data'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Risks of unauthenticated RCE flaws in business-critical '
'systems, importance of timely patching, and monitoring '
'for unusual outbound activity.',
'motivation': 'Financial gain, Intellectual property theft, Double-extortion',
'post_incident_analysis': {'corrective_actions': 'Immediate patching, '
'IoC-based hunting, log '
'review for compromise',
'root_causes': 'Unpatched critical vulnerabilities '
'(CVE-2026-12569, FlexPLM WSDL '
'endpoint, Windchill login servlet '
'weakness)'},
'ransomware': {'data_exfiltration': True, 'ransomware_strain': 'Cl0p'},
'recommendations': ['Patch vulnerable Windchill/FlexPLM servers immediately',
'Hunt for compromise dating back to early June using '
'published IoCs',
'Review access logs for unusual outbound activity and '
'unexpected JSP files',
'Preserve extortion emails for forensic analysis'],
'references': [{'source': 'Ransom-ISAC'},
{'source': 'eCrime.ch'},
{'source': 'DEFUSED'},
{'source': 'CISA Known Exploited Vulnerabilities (KEV) '
'catalog'}],
'response': {'communication_strategy': 'Extortion emails sent to employees '
'from compromised accounts',
'containment_measures': 'Patch vulnerable Windchill/FlexPLM '
'servers, hunt for compromise using '
'IoCs, review access logs',
'enhanced_monitoring': 'Monitor for IoCs (C2 IP addresses, JSP '
'webshells, reconnaissance requests)',
'remediation_measures': 'Immediate patching of CVE-2026-12569 '
'and related vulnerabilities',
'third_party_assistance': 'Ransom-ISAC, eCrime.ch, DEFUSED'},
'threat_actor': 'Cl0p ransomware affiliates',
'title': 'Cl0p Ransomware Exploits PTC Windchill Servers in Targeted Data '
'Theft Campaign',
'type': 'Ransomware, Data Theft',
'vulnerability_exploited': ['CVE-2026-12569 (CVSS 9.8)',
'Pre-authentication information disclosure in '
'FlexPLM WSDL endpoint',
'Windchill login servlet weakness enabling RCE']}