MalwareBleeping Computer
9.8 — CRITICAL
Clop created custom web shell for Windchill data theft attacks
A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A custom Java web shell, linked to the Clop ransomware gang, was designed specifically for PTC Windchill and FlexPLM servers, allowing attackers to decrypt credentials, enumerate file repositories, and steal files.
⚙️Technical Details
CVEs
CVE-2026-12569
Affected Systems
PTC WindchillPTC FlexPLM
Attack Vectors
NETWORK
💥Impact Assessment
Severity: critical
Who Is at Risk
Organizations with exposed PTC Windchill and FlexPLM servers
🛡️Recommended Actions
1Immediately patch vulnerable Windchill systems
2Look for unusual JSP files in Windchill directories, especially those containing reference to X-windchill-req
3Change the LDAP manager password and other Windchill credentials if compromised
📦Affected Products
Ptc FlexplmPtc Windchill PdmlinkPTC WindchillPTC FlexPLM
🔐NVD Verified DataVERIFIED
CVE-2026-12569 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-20CWE-502
Affected Products (CPE)
Ptc FlexplmPtc Windchill Pdmlink
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.