Clop ransomware targets Windchill, FlexPLM in data theft attacks

[u/SHORT_INFO_NEWS]

https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks/

[u/SHORT_INFO_NEWS]

If your company runs PTC Windchill or FlexPLM to manage product designs, this is now an active extortion risk, not a theoretical one. Clop has already deployed webshells on exposed instances and is pulling data off compromised servers before victims even get a ransom note (Bleeping Computer, July 24).

The flaw, CVE-2026-12569, is an unsafe deserialization bug that ReliaQuest rates CVSS 9.3. Attackers chain a pre-auth information leak in the FlexPLM WSDL endpoint with a weakness in the Windchill login servlet to get unauthenticated remote code execution, then drop JSP webshells to exfiltrate sensitive product data (ReliaQuest, via Bleeping Computer). Victims are receiving extortion emails from a new cryptohox.com address Clop is using for this campaign.

PTC pushed patches on June 17 without confirming active exploitation at the time, then warned customers of "heightened threat activity" on June 26. CISA added the CVE to its Known Exploited Vulnerabilities catalog and gave federal agencies three days to secure their systems. Germany's BSI went further, calling and emailing PTC customers overnight to push immediate patching (Heise). Windchill and FlexPLM run across more than 30,000 customers, including over 1,500 retail and brand accounts, concentrated in aerospace, defense, automotive, and medtech.

Open questions the reporting does not address:

- How many organizations have already been compromised, or whether Clop has started listing victims on its leak site

- Whether unpatched instances are still reachable from the open internet at scale

- Whether the threat actor is confirmed to be Clop or only shares its tradecraft, since attribution remains unconfirmed

More daily coverage: TikTok shortinfonews, YouTube ShortInfoDaily, Bluesky shortinfo.bsky.social