cyber.hendryadrian.com
Security News · cyberscoop.com

Clop Claims Data Theft from Dozens in PTC Zero-Day Campaign

· Original article ↗

Summary

Clop claims it stole data from dozens of organizations by exploiting CVE-2026-12569 in PTC Windchill and FlexPLM. Toast and Zebra said they detected and contained intrusions with limited impact; PTC issued a patch in June.

Key points

  • Clop reportedly began sending extortion emails to alleged victims in mid-July; Ransom-ISAC said some victims were likely compromised in early June.
  • The campaign targeted CVE-2026-12569, an unauthenticated remote code execution flaw affecting PTC Windchill and FlexPLM.
  • PTC disclosed the flaw on June 17 and issued a patch and initial indicators of compromise the following day. CISA added it to its known exploited vulnerabilities catalog on June 25.
  • ReliaQuest researchers described a custom Windchill web shell and toolkit for credential theft, malware delivery, sustained access, network traversal, and data theft and encryption.
  • Toast and Zebra told CyberScoop they detected and contained intrusions and reported limited impact. GE, Philips, and Shell did not respond to requests for comment.
  • PTC had not said when it first learned of the vulnerability and attacks or how many customers were known to be compromised.

Article Details

Event Type
Zero-day exploitation and data-theft extortion campaign
Impact
Researchers attributed exploitation of CVE-2026-12569 in PTC Windchill and FlexPLM to Clop. The campaign allegedly affected dozens of organizations; Toast and Zebra said they detected and contained intrusions with limited impact, while GE, Philips, and Shell did not comment. PTC disclosed the vulnerability and issued a patch in June 2026.

CVE

CVE-2026-12569Clop exploited the zero-day CVE-2026-12569 in PTC’s Windchill and FlexPLM platforms to conduct a large-scale data theft extortion campaign against dozens of organizations.

People

Allan LiskaField chief information security officer at Recorded Future; commented on Clop’s pattern of targeting platforms with zero-days and conducting mass-exploitation campaigns.

Threat Actors

ClopResearchers attributed the campaign exploiting CVE-2026-12569 in PTC products to Clop. The group reportedly sent extortion emails to alleged victims in mid-July and claimed to have stolen data from dozens of organizations.

Vendors

PTCClop exploited the zero-day CVE-2026-12569 in PTC’s Windchill and FlexPLM platforms to conduct a large-scale data theft extortion campaign against dozens of organizations.

Products

FlexPLMClop exploited the zero-day CVE-2026-12569 in PTC’s Windchill and FlexPLM platforms to conduct a large-scale data theft extortion campaign against dozens of organizations.PTC WindchillClop exploited the zero-day CVE-2026-12569 in PTC’s Windchill and FlexPLM platforms to conduct a large-scale data theft extortion campaign against dozens of organizations.

Industries

AerospacePTC — Windchill and FlexPLM — which manufacturers and retailers, particularly in the manufacturing, aerospace, and automotive industries, use to automate supply chain systems and manage product lifecycles.Automotiveand FlexPLM — which manufacturers and retailers, particularly in the manufacturing, aerospace, and automotive industries, use to automate supply chain systems and manage product lifecycles.Manufacturingproducts from PTC — Windchill and FlexPLM — which manufacturers and retailers, particularly in the manufacturing, aerospace, and automotive industries, use to automate supply chain systems and manage product

Related Articles