A custom Java web shell linked to the Clop ransomware gang has been used to target PTC Windchill and FlexPLM servers, cybersecurity firm ReliaQuest reports.
The web shell was found after attackers exploited CVE-2026-12569, a critical remote code execution flaw in PTC Windchill. The malware can connect to Windchill databases, decrypt stored credentials, search file repositories and steal files. It also uses a custom X-windchill-req HTTP header to receive commands.
ReliaQuest believes the attacks are linked to Clop based on extortion emails, techniques used in previous Clop campaigns and similarities between the web shell and earlier activity.
“This appears to be an application-specific evolution of Clop's established mass-exploitation playbook. The web shell is purpose-built to target this tool: it embeds detailed knowledge of the application's APIs, database schema, keystore, and file-vault structure, enabling rapid movement from access to data theft, without external commands or additional tools. References to “Clop” throughout reflect this highly likely attribution,” the company noted in its report.
Clop has previously targeted enterprise file-sharing and data-transfer platforms, including MOVEit, GoAnywhere, Accellion and Cleo.
Organizations are recommended to patch vulnerable Windchill systems as soon as possible and search for unusual JSP files, especially files containing references to X-windchill-req. Companies should also change Windchill and LDAP credentials if a security breach is suspected.