Cl0p ransomware affiliates are exploiting exposed PTC Windchill and FlexPLM servers to steal engineering and product-design data. <\/p>\n
The campaign combines software flaws to gain access without credentials, install hidden server-side access, and remove sensitive files before demanding payment.<\/a><\/p>\n The activity places manufacturers, automotive firms, aerospace organizations, and retail apparel companies at particular risk because Windchill systems can hold highly valuable product records. <\/p>\n Attackers use a double-extortion model, allowing them to pressure victims with stolen data even when systems can be recovered from backups.<\/a><\/p>\n Analysts at Ransom-ISAC, working with eCrime.ch and DEFUSED, identified active exploitation and warned that unpatched, internet-facing deployments remain the main entry point. <\/p>\n The activity is linked to Cl0p affiliates, an operation also known as Graceful Spider, Chubby Scorpius, FIN11, and Lace Tempest.<\/a><\/p>\n Ransom-ISAC\u00a0said in a report<\/a> shared with Cyber Security News (CSN) that the intrusions appear to date back to early June and have been followed by mass extortion emails sent through randomly compromised accounts. <\/p>\n The messages force organizations to investigate possible theft quickly while also protecting employees from follow-on phishing and social-engineering attempts.<\/a><\/p>\n The attack begins with a pre-authentication information disclosure in the FlexPLM WSDL endpoint, followed by abuse of a weakness in the Windchill login servlet. <\/p>\n Chaining the two flaws gives attackers a way to execute code remotely without a valid account and establish a foothold on the server.<\/a><\/p>\n The key vulnerability, CVE-2026-12569, is a critical deserialization flaw with a CVSS score of 9.8 that affects PTC Windchill PDMLink and FlexPLM releases before 11.0 M030. It was disclosed on June 17, while CISA added it to its Known Exploited Vulnerabilities catalog on June 25.<\/a><\/p>\n After gaining access, the operators deploy JSP webshells, inspect server files, and stage engineering data for theft. <\/p>\n The incident follows the pattern seen in\u00a0recent Cl0p ransomware actor campaigns<\/a>, where an exposed enterprise application can become a direct route to confidential data and public extortion.<\/a><\/p>\n This is especially concerning for organizations that use Windchill to manage design documents, product specifications, and development workflows. <\/p>\n A successful breach can expose intellectual property that is difficult to replace and may give competitors or criminal buyers insight into unreleased products.<\/p>\n The attackers did not need to break through an employee mailbox or trick a user into opening a malicious attachment. <\/p>\n Instead, they targeted a public-facing application, underscoring why organizations should continuously identify internet-exposed systems and rapidly apply security updates for high-impact vulnerabilities.<\/p>\n On July 20, Ransom-ISAC began observing emails with the subject line \u201cWindchill PDMLink module serious data leak\u201d sent to hundreds of employees at affected organizations. <\/p>\n This approach spreads the breach allegation internally and increases pressure on executives and incident-response teams before a victim is named publicly.<\/a><\/p>\n The tactic is similar to last year\u2019s Oracle EBS campaign, although the current operation uses new email addresses. <\/p>\n Organizations facing such messages should preserve the emails and headers, validate the claim through internal investigation, and remind employees to report suspicious communications, as seen in\u00a0reported Oracle EBS breach investigations<\/a>.<\/a><\/a><\/p>\n The organizations receiving matching emails should hunt for compromise dating back to early June, use published indicators, apply fixed builds, and follow the vendor\u2019s remediation guidance.<\/a><\/p>\n Security teams should give immediate priority to externally reachable Windchill and FlexPLM servers, check for unexpected JSP files and unusual outbound activity, and review access logs for the noted reconnaissance request. <\/p>\n Monitoring\u00a0CISA KEV catalog alerts<\/a>\u00a0can also help teams focus patching work on flaws known to be exploited.<\/a><\/a><\/p>\n The case also highlights the danger of unauthenticated code-execution flaws in business-critical systems. <\/p>\n Similar\u00a0unauthenticated remote code risks<\/a>\u00a0have shown how quickly a server vulnerability can become a broader data-theft incident when patches are delayed.<\/p>\n Indicators of compromise (IoCs):-<\/strong><\/a><\/p>\n Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em> ALERT!: 20+ government sites delivered malware to businesses and citizens. <\/strong>See full attack research<\/strong><\/a> to check your own exposure.<\/strong><\/p>\n The post Cl0p Hackers Exploit Windchill Servers to Steal Companies\u2019 Secret Product Designs<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nCl0p Hackers Exploit Windchill Servers<\/strong><\/h2>\n
![\"Extortion](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhg27pN2QkcozOWO0VygxxsD92ULUSzI758dW5rgmu7sB0d4stKL3L1mFY68Fkz4VSXL2JWU8ENucpz38DTZVpSMY8rVAVECzX89PRX7DNil-LL4kqORW-4RKYYRU8SohFnC4FGCLppviX0D2x4aIVn5cD0bwB-1CqdaYvKkiZKJ5RII8YcrKeocIBgfoQ\/s1600\/Extortion%2520email%2520sent%2520to%2520employees%2520across%2520the%2520victim%2520organization%2520%28Source%2520-%2520Ransom-ISAC%29.webp?ssl=1\")
Extortion Campaign Raises Pressure<\/strong><\/h2>\n
![\"A](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiRK0yO2p3935Crp_wTke7PcGlzlqpm0mJQEp3QnkLkbbwyBPHRy2dkgpl_IO1pV2AOvAPVpat83oxYA7N74HPCLhKjPv7M5MHT89z5j1VsCWuzO2wAlA13ksii-cDG0gEd6Hp3goqUCokQCfU_OjeErAHhhqKsGpDtmdmCHT2uEUB4mgBP5nXOz6aejaQ\/s1600\/A%2520further%2520extortion%2520email%2520to%2520the%2520same%2520recipients%2520%28Source%2520-%2520Ransom-ISAC%29.webp?ssl=1\")
\n\n
\n \nType<\/th>\n Indicator<\/th>\n Description<\/th>\n<\/tr>\n<\/thead>\n \n IP address<\/td>\n 216.152.148.54<\/td>\n Newly published C2 indicator<\/td>\n<\/tr>\n \n IP address<\/td>\n 216.152.151.204<\/td>\n Newly published C2 indicator<\/td>\n<\/tr>\n \n IP address<\/td>\n 104.243.35.63<\/td>\n Newly published C2 indicator<\/td>\n<\/tr>\n \n IP address<\/td>\n 5.180.41.35<\/td>\n Newly published C2 indicator<\/td>\n<\/tr>\n \n SHA-256<\/td>\n 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c<\/td>\n Published hash indicator<\/td>\n<\/tr>\n \n HTTP header<\/td>\n X-windchill-req: ?x8Fmgow<\/code><\/td>\nMalicious request header<\/td>\n<\/tr>\n \n Webshell path<\/td>\n Windchill\/login\/[0-9a-f]{16}.jsp<\/code><\/td>\nHunt path for hex-named JSP webshells<\/td>\n<\/tr>\n \n File name<\/td>\n flst.txt<\/code><\/td>\nFile listing artifact<\/td>\n<\/tr>\n \n Reconnaissance request<\/td>\n GET \/Windchill\/rfa\/jsp\/login.jsp?wsdl<\/code><\/td>\nObserved pre-attack WSDL request<\/td>\n<\/tr>\n \n Response size<\/td>\n \n 40454<\/code>\u00a0bytes<\/td>\nResponse size associated with the reconnaissance request<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n [.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n