Cl0p Affiliates Exploit PTC Windchill and FlexPLM in Active Campaign
Summary
Ransom-ISAC reports Cl0p affiliates are exploiting internet-exposed PTC Windchill and FlexPLM through a flaw chain, deploying JSP webshells and stealing data. PTC has issued fixes; no victims were publicly listed as of July 22.
Key points
- Ransom-ISAC reports Cl0p affiliates are targeting internet-exposed PTC Windchill and FlexPLM deployments.
- The reported chain combines a FlexPLM WSDL information-disclosure flaw with a Windchill login servlet flaw to enable unauthenticated remote code execution.
- The advisory describes hex-named JSP webshells, file enumeration, engineering-data staging, and alleged double-extortion data theft.
- Ransom-ISAC suspects CVE-2026-12569 was exploited as a zero-day in early June 2026; it says the flaw affects releases before 11.0 M030.
- PTC has released fixed builds. The advisory recommends threat hunting back to early June and applying PTC remediation steps.
- As of July 22, the advisory said Cl0p had not publicly claimed the campaign or listed its victims on its leak site.
Article Details
- Event Type
- Cl0p ransomware-affiliate exploitation and data-extortion campaign targeting internet-exposed PTC Windchill and FlexPLM systems.
- Impact
- The reported attack chain enables unauthenticated remote code execution, followed by JSP webshell deployment, file enumeration, engineering-data staging, data theft, and extortion emails. The advisory identifies victims in Manufacturing, Automotive, Aerospace, and Retail/Apparel. PTC has released fixes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]243[.]35[.]63 | Listed by the advisory as a new C2 indicator. |
| IPV4 | 216[.]152[.]148[.]54 | Listed by the advisory as a new C2 indicator. |
| IPV4 | 216[.]152[.]151[.]204 | Listed by the advisory as a new C2 indicator. |
| IPV4 | 5[.]180[.]41[.]35 | Listed by the advisory as a new C2 indicator and marked priority block. |
| SHA256 | 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c | Explicitly identified in the advisory as a SHA-256 hash IOC. |
MITRE ATT&CK
CVE
Threat Actors
Chubby ScorpiusThe advisory explicitly gives Chubby Scorpius as an alias for Cl0p ransomware; the campaign is described as alleged, and Cl0p-affiliated involvement is not presented as fully confirmed.Cl0pThe advisory reports Cl0p-affiliated ransomware activity and describes the extortion campaign as alleged; it suspects affiliates most likely exploited CVE-2026-12569 as a zero-day in early June 2026.FIN11The advisory explicitly gives FIN11 as an alias for Cl0p ransomware; the campaign is described as alleged, and Cl0p-affiliated involvement is not presented as fully confirmed.GRACEFUL SPIDERThe advisory explicitly gives Graceful Spider as an alias for Cl0p ransomware; the campaign is described as alleged, and Cl0p-affiliated involvement is not presented as fully confirmed.TA505The advisory explicitly gives Lace Tempest as an alias for Cl0p ransomware; the campaign is described as alleged, and Cl0p-affiliated involvement is not presented as fully confirmed.
Malware
Vendors
Products
PTC FlexPLMdescribes an active Cl0p ransomware affiliate campaign targeting internet-exposed PTC Windchill and FlexPLM systems by chaining a FlexPLM WSDL information disclosure flaw with a Windchill login servletPTC WindchillThis advisory describes an active Cl0p ransomware affiliate campaign targeting internet-exposed PTC Windchill and FlexPLM systems by chaining a FlexPLM WSDL information disclosure flaw with a Windchill login servletWindchill PDMLinkChubby Scorpius, FIN11, Lace Tempest) data extortion campaign sending emails with a subject line, “Windchill PDMLink module serious data leak” to an unknown number of affected organizations (Figure 1 & Figure 2).
Industries
AerospaceIt also details post-exploitation webshell deployment, data theft, and extortion emails sent to affected organizations across Manufacturing, Automotive, Aerospace, and Retail/Apparel sectors.AutomotiveIt also details post-exploitation webshell deployment, data theft, and extortion emails sent to affected organizations across Manufacturing, Automotive, Aerospace, and Retail/Apparel sectors.ManufacturingIt also details post-exploitation webshell deployment, data theft, and extortion emails sent to affected organizations across Manufacturing, Automotive, Aerospace, and Retail/Apparel sectors.Retail/apparelIt also details post-exploitation webshell deployment, data theft, and extortion emails sent to affected organizations across Manufacturing, Automotive, Aerospace, and Retail/Apparel sectors.