ReliaQuest Details Windchill Web Shell Likely Linked to Clop
Summary
ReliaQuest analyzed a Windchill-specific JSP web shell likely linked to Clop and deployed in attacks exploiting CVE-2026-12569. It can decrypt stored credentials, map vaults, retrieve or delete files, and execute Java code; patching and credential rotation are advised.
Key points
- ReliaQuest analyzed a JSP web shell built specifically for PTC Windchill and FlexPLM, rather than a generic shell adapted for the attacks.
- The shell uses Windchill classes to access its database and decrypt stored credentials; its queries may appear under the application’s normal database identity.
- A custom protocol in the X-windchill-req HTTP header controls commands to steal configuration, map file vaults, enumerate directories, and retrieve or delete files.
- The shell can load and execute additional Java code in the Windchill process.
- ReliaQuest assesses Clop attribution as likely, citing extortion-email addresses, a previously observed header, and actor-associated TTPs.
- The activity is linked in the report to exploitation of CVE-2026-12569; PTC began releasing fixes on June 17, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.
- ReliaQuest recommends patching Windchill, checking for unusual JSP files and X-windchill-req references, and rotating LDAP manager and other Windchill credentials if compromise is suspected.
Article Details
- Attack Vectors
- The activity is reported as involving exploitation of CVE-2026-12569, a remote code execution vulnerability affecting PTC Windchill, followed by deployment of a JSP web shell.
- The custom shell uses Windchill APIs and database access to decrypt stored LDAP credentials, enumerate file-vault contents, and retrieve files.
- The shell accepts commands through the X-windchill-req HTTP header, including file deletion and loading and executing Base64-encoded Java bytecode in memory.
- Defensive Notes
- Patch vulnerable Windchill systems; PTC began releasing fixes for CVE-2026-12569 on June 17.
- Look for unusual JSP files in Windchill directories, particularly files referencing X-windchill-req.
- If compromise is suspected, change the LDAP manager password and other Windchill credentials, which should be treated as compromised.
MITRE ATT&CK
T1005 · Data from Local SystemThe shell reads and retrieves files from supplied paths and Windchill vaults.T1070.004 · File DeletionOne supported shell command deletes a specified file.T1083 · File and Directory DiscoveryThe shell enumerates directories and maps Windchill file-vault paths and filenames.T1505.003 · Web ShellA JSP web shell was deployed on Windchill servers and controlled through the X-windchill-req HTTP header.T1552.001 · Credentials In FilesThe shell reads Windchill LDAP configuration and decrypts the LDAP manager password and other stored application data.T1620 · Reflective Code LoadingThe shell loads compiled Java bytecode from a Base64-encoded ZIP archive into memory and executes it within the Windchill process.
CVE
Threat Actors
Vendors
Products
FlexPLMReliaQuest uncovered a custom JSP web shell likely tied to Clop that was built specifically for PTC Windchill and FlexPLM, with functions to decrypt credentials, enumerate vaults, and steal files.PTC WindchillReliaQuest uncovered a custom JSP web shell likely tied to Clop that was built specifically for PTC Windchill and FlexPLM, with functions to decrypt credentials, enumerate vaults, and steal files.