ReliaQuest found Clop-linked attacks using CVE-2026-12569 in PTC Windchill and FlexPLM to drop a bespoke JSP web shell, and SecurityWeek says Clop has now publicly named more than 40 victims. The implant is built for Windchill, not just generic command execution: it can map vault data, decrypt credentials, and load more Java code in memory.
That makes the compromise more than PLM data theft. The shell already knows Windchill’s internal layout, so it can pull working credentials out of the application’s keystore and use them for follow-on access instead of relying on separate stolen passwords or extra tooling.
For manufacturing, transportation, and retail shops running these platforms, the exposure can extend into systems tied to the PLM stack long after the first web shell is removed. If Windchill holds secrets for integrated engineering or identity-linked services, the breach can become a pivot into those downstream systems as well.
The data theft extortion group likely compromised a critical vulnerability affecting PTC’s product lifecycle management software in June, a month before it sent threatening emails to victims.
A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files.