cyber.hendryadrian.com
Security News · securityweek.com

Cl0p Names More Than 40 Alleged Victims in PTC Windchill Campaign

· Original article ↗

Summary

Cl0p has named more than 40 alleged victims of a Windchill and FlexPLM campaign exploiting CVE-2026-12569. Several companies are investigating the claims; none has confirmed a significant data breach.

Key points

  • CVE-2026-12569 is an improper input validation flaw that reportedly allows remote, unauthenticated arbitrary code execution through specially crafted requests.
  • The article reports that Cl0p affiliates exploited the flaw to deploy web shells and access data at organizations using Windchill.
  • ReliaQuest reported that a custom implant can map sensitive vault data, decrypt Windchill keystore credentials, and execute additional code within the application process.
  • Cl0p has named more than 40 organizations and claims to have stolen data ranging from 1 GB to several terabytes per organization; these are group claims, not independently confirmed amounts.
  • Shell, Philips, Fiserv and GE said they were aware of the claims and investigating; none confirmed a significant data breach.

Article Details

Event Type
Cl0p ransomware data-theft and extortion campaign exploiting a vulnerability in PTC Windchill and FlexPLM.
Impact
Cl0p allegedly targeted more than 40 organizations and claimed to have stolen data ranging from 1 GB to several terabytes per organization, including databases, project files, backups, engineering documents, and other corporate information. The article says the files could contain personal information and intellectual property, but none of the named companies confirmed a significant data breach.

CVE

CVE-2026-12569The exploitation of the vulnerability, tracked as CVE-2026-12569, came to light in June, when CISA added it to its KEV catalog and the vendor warned of attacks targeting it.

Threat Actors

Cl0pThe article reports that Cl0p exploited the PTC vulnerability in ransomware-related attacks, allegedly stealing data from more than 40 organizations and naming them on its website.

Vendors

PTCThe Cl0p ransomware group has named more than 40 organizations allegedly targeted in the recent campaign that exploited a vulnerability in PTC’s product lifecycle management (PLM) platforms Windchill and FlexPLM.

Products

FlexPLMThe Cl0p ransomware group has named more than 40 organizations allegedly targeted in the recent campaign that exploited a vulnerability in PTC’s product lifecycle management (PLM) platforms Windchill and FlexPLM.PTC WindchillThe Cl0p ransomware group has named more than 40 organizations allegedly targeted in the recent campaign that exploited a vulnerability in PTC’s product lifecycle management (PLM) platforms Windchill and FlexPLM.

Industries

medical technologyindustrial equipment manufacturer Ingersoll Rand, point-of-sale software maker Toast, global medical technology leader Mindray, and key Apple camera lens supplier Largan Precision.Oil and gasThe list of alleged victims includes oil and gas giant Shell, tech giant Philips, fintech giant Fiserv, enterprise mobility provider Zebra Technologies, industrial equipment manufacturer Ingersoll Rand, point-of-salePoint-of-sale softwaremobility provider Zebra Technologies, industrial equipment manufacturer Ingersoll Rand, point-of-sale software maker Toast, global medical technology leader Mindray, and key Apple camera lens supplier LarganTechnologyindustrial equipment manufacturer Ingersoll Rand, point-of-sale software maker Toast, global medical technology leader Mindray, and key Apple camera lens supplier Largan Precision.

Related Articles