ReliaQuest found a custom Java web shell aimed at PTC Windchill and FlexPLM in Clop-linked data theft attacks exploiting CVE-2026-12569. The implant is not a generic post-exploitation tool; it was built with Windchill-specific knowledge and can decrypt stored credentials, list repositories, and steal files.
That matters because the shell uses the product’s own internals against it. Instead of just sitting on a server, it can reach into Windchill’s secret stores and file vaults the way an admin tool would, so an attacker may already have pulled credentials and selected data before anyone notices the web shell itself.
For teams running Windchill, FlexPLM, or Windchill PDMlink, the exposure is not limited to the compromised host. If the platform stores secrets and proprietary files inside its own trust boundary, a hit can leave both access tokens and data repositories at risk even after the obvious payload is removed.