Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
Summary: ReliaQuest found a JSP web shell built specifically for PTC Windchill and FlexPLM servers, deployed after exploitation of CVE-2026-12569, an improper input validation flaw with a CVSS score of 9.3. The implant decrypts every credential in the Windchill keystore, harvests LDAP credentials in plaintext via an 'S' command, enumerates the file vault, and loads attacker-supplied Java bytecode from a Base64-encoded ZIP into memory, with Ransom-ISAC, eCrime.ch and Defused attributing the activity to Clop.
What you should know: Because LDAP credentials typically govern access to Active Directory, email, VPN and other directory-tied services, one compromised PLM server can become an enterprise-wide credential compromise - and the shell runs inside Windchill's own trust boundary using its own database connections, so signature-based defenses see traffic that looks like normal application use.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-12569
- Related
- CVE-2026-12569: PTC Windchill and FlexPLM Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Jun 25, 2026