What Changed
ReliaQuest has analyzed a custom JSP web shell built for PTC Windchill and FlexPLM product lifecycle management servers. The attacks exploit CVE-2026-12569, which PTC began fixing on June 17 and which is in CISA’s KEV catalog. The activity is linked to the Clop extortion gang through extortion emails sent to victims, which Ransom-ISAC confirmed.
How The Web Shell Works
The shell is built on Windchill’s own classes, including MethodContext, WTConnection and WTKeyStoreUtil. It is controlled through the X-windchill-req HTTP header and supports single-letter commands, including one that writes a file list to flst.txt. It queries Windchill tables such as ApplicationData, FVITEM, FVMOUNT and MasteredOnReplicaItem to find stored files and where they are kept, which supports bulk theft of design data.
Why This Is An Operations Problem
PLM systems hold engineering drawings, product designs and supplier data, among the most valuable intellectual property a manufacturer has. Clop has repeatedly run mass data-theft campaigns against a single enterprise product, followed by extortion, and a tool written for Windchill’s internals points to the same approach.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What To Verify First
- Apply PTC’s fixes for CVE-2026-12569 on all Windchill and FlexPLM servers.
- Hunt for JSP files on Windchill servers that reference
X-windchill-req. - Rotate the Windchill LDAP manager password, as ReliaQuest recommends.
- Review outbound data volumes from PLM servers since mid-June.
What Teams May Be Underestimating
Patching after compromise does not remove a web shell or undo stolen data. Organizations that patched late should hunt before assuming they are clean. If the investigation finds data was taken, expect an extortion email to follow, as other Windchill victims have received.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Friday’s brief: forgotten servers on a seven-country advisory, then Splunk, Bricksforge and exposed dashboards
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
