Clop-Linked Campaign Exploits PTC Windchill and FlexPLM Flaw for Data Theft
Summary
ReliaQuest reports active exploitation of CVE-2026-12569 in exposed PTC Windchill and FlexPLM systems, with JSP web shells used to steal data. The attacker’s identity is unconfirmed; PTC, CISA, and BSI urged urgent remediation.
Key points
- ReliaQuest observed active exploitation of CVE-2026-12569, a critical flaw affecting Internet-exposed PTC Windchill and FlexPLM instances that can enable unauthenticated remote code execution.
- Attackers reportedly deployed JSP web shells to execute commands and exfiltrate sensitive product data.
- The actor behind the observed attacks remains unconfirmed; ReliaQuest said the tradecraft resembles previous Cl0p campaigns. BleepingComputer also reported extortion emails using an address it linked to the gang.
- PTC began releasing patches on June 17 and urged customers to review systems for indicators of compromise, but did not confirm exploitation in the wild.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog and directed U.S. federal agencies to secure affected systems within three days; BSI also urged PTC customers to patch.
- ReliaQuest advised patching, restricting access behind VPNs or trusted access gateways, and, if compromise is suspected, isolating affected servers, collecting forensic artifacts, and rotating exposed credentials.
Article Details
- Event Type
- Reported exploitation of a vulnerability in PTC Windchill and FlexPLM in a data-theft extortion campaign
- Impact
- Attackers reportedly exploit CVE-2026-12569 for unauthenticated remote code execution and deploy JSP web shells to steal sensitive product data from compromised systems. The article reports extortion emails and says the attribution of the observed attacks remains unconfirmed, although the activity resembles previous Cl0p campaigns. PTC, CISA, and German authorities urged customers to patch and check for compromise.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
support@cryptohox[.]com | Email address reported as being used for extortion emails associated with the Clop campaign. |
MITRE ATT&CK
CVE
Threat Actors
Cl0pThe article identifies Cl0p as another name for Clop and says the observed tradecraft resembles previous Cl0p campaigns; ReliaQuest says the actor behind the observed attacks remains unconfirmed.ClopThe article identifies Clop as targeting Windchill and FlexPLM and associates the extortion emails with the group. ReliaQuest says the actor behind the observed attacks remains unconfirmed.
Vendors
Products
PTC FlexPLMPTC Windchill and PTC FlexPLM are enterprise software platforms in a category known as Product Lifecycle Management (PLM), used to track, design, and manage products from original idea to final manufacturing.PTC WindchillClop (also known as Cl0p) is exploiting CVE-2026-12569 to attack Internet-exposed PTC Windchill and FlexPLM instances, using JSP web shells to steal sensitive product data in a new extortion campaign.
Industries
AerospaceThe two PLM systems are widely popular among engineering, manufacturing, quality, and supply chain teams across high-profile companies in the aerospace, defense, automotive, heavy machinery, retail, and medtech sectors.AutomotiveThe two PLM systems are widely popular among engineering, manufacturing, quality, and supply chain teams across high-profile companies in the aerospace, defense, automotive, heavy machinery, retail, and medtech sectors.DefenseThe two PLM systems are widely popular among engineering, manufacturing, quality, and supply chain teams across high-profile companies in the aerospace, defense, automotive, heavy machinery, retail, and medtech sectors.heavy machineryThe two PLM systems are widely popular among engineering, manufacturing, quality, and supply chain teams across high-profile companies in the aerospace, defense, automotive, heavy machinery, retail, and medtech sectors.medtechThe two PLM systems are widely popular among engineering, manufacturing, quality, and supply chain teams across high-profile companies in the aerospace, defense, automotive, heavy machinery, retail, and medtech sectors.RetailThe two PLM systems are widely popular among engineering, manufacturing, quality, and supply chain teams across high-profile companies in the aerospace, defense, automotive, heavy machinery, retail, and medtech sectors.