A Clop web shell built for Windchill
ReliaQuest has analyzed a custom JSP web shell built for PTC Windchill and FlexPLM product lifecycle management servers. The attacks exploit CVE-2026-12569, which PTC began fixing on June 17 and which is in CISA’s KEV catalog. The activity is linked to the Clop extortion gang through extortion emails sent to victims, which Ransom-ISAC confirmed.
Commands through one HTTP header
The shell is built on Windchill’s own classes, including MethodContext, WTConnection and WTKeyStoreUtil. It is controlled through the X-windchill-req HTTP header and supports single-letter commands, including one that writes a file list to flst.txt. It queries Windchill tables such as ApplicationData, FVITEM, FVMOUNT and MasteredOnReplicaItem to find stored files and where they are kept, which supports bulk theft of design data.
Why Clop wants PLM data
PLM systems hold engineering drawings, product designs and supplier data. For a manufacturer, little is worth more. Clop has run this play before: mass data theft through one enterprise product, then extortion. A tool written for Windchill’s internals points the same way.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Patch CVE-2026-12569 and hunt for the shell
- Apply PTC’s fixes for CVE-2026-12569 on all Windchill and FlexPLM servers.
- Hunt for JSP files on Windchill servers that reference
X-windchill-req. - Rotate the Windchill LDAP manager password, as ReliaQuest recommends.
- Review outbound data volumes from PLM servers since mid-June.
A late patch leaves the shell in place
Patching after a compromise leaves the web shell where it is, and stolen data stays stolen. If you patched late, hunt first. If the investigation finds data was taken, expect an extortion email to follow, as other Windchill victims have received.
Source Context
Primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
