Anatomy of an Attack

Cl0p's summer 2026 campaign followed the group's familiar playbook: find a widely deployed enterprise application, exploit it at scale, and extort the victims. This time their target was vulnerable PTC Windchill and FlexPLM deployments (CVE-2026-12569). What set this campaign apart was the implant. The operators built a Windchill-specific JSP web shell around the application's internal architecture, calling its own classes to decrypt the keystore, walk the database schema, and map the file vault.

By mid-August, Cl0p had named more than 40 alleged victims, though those claims remain unverified. Two of the named companies, Philips and Fiserv, said they found no evidence that data was taken. Despite Cl0p being a ransomware group, this campaign documents data theft and extortion without performing file encryption.

A single isolated Windchill-related event can look benign, as the implant runs inside a trusted process under Windchill's database identity. Detection of malicious activity depends on the surrounding sequence: external reconnaissance, unusual requests to login-path JSP files, a campaign-specific HTTP header, rare vault-table access, and large compressed HTTP responses. Much of that evidence sits inside encrypted sessions; RevealX passively decrypts both the internet-facing and application-to-database paths so analysts can inspect the header, JSP names, and vault queries directly.

The Cl0p Windchill Attack Lifecycle

Phase 1: Reconnaissance and Initial Access

Ransom-ISAC’s analysis describes a two-part exploit chain: a FlexPLM Web Services Description Language (WSDL) endpoint pre-authentication information-disclosure flaw, combined with the Windchill PTC Windchill PDMlink and PTC FlexPLMlogin servlet vulnerability (CVE-2026-12569) [T1190]. Chained together, the two vulnerabilities gave the operators unauthenticated remote code execution on internet-exposed deployments. In addition, PTC announced on August 20 that the same product lineup contains an RCE vulnerability (CVE-2026-77645) and an SSRF vulnerability (CVE-2026-77646), both exploitable via untrusted data deserialization.

The reconnaissance that preceded exploitation left a distinctive trace. PTC’s hunting guidance flags a pattern: an HTTP GET request to /Windchill/rfa/jsp/login/*.jsp?wsdl followed by a response of 4,045 bytes.

Hunt for the behavior: Query network logs back to early June for this fixed request pattern paired with the fixed response size.

Phase 2: The Windchill-Specific Web Shell

The operators dropped persistent JSP web shells [T1505.003] into the /Windchill/login/ path, likely to blend the files among the application’s own resources. PTC observed three naming patterns: 16-character hexadecimal names, six-character hexadecimal filenames, and names beginning with dpr_ followed by eight hexadecimal characters.

The implant accepts C2 instructions through the custom HTTP header X-windchill-req  [T1071.001], with PTC reporting one of the header’s values as ?x8Fmgow, in which the first character following the question mark ‘?’ specifies a command.

Hunt for the behavior: Search for the hexadecimal or dpr_ naming conventions in the Windchill web root and web server logs as request targets. Search for the customer HTTP header X-windchill-req.

Naming convention examples

• [URL]/Windchill/login/7c0a0a34c9d8d53b[.]jsp
• dpr_0123abcd[.]jsp

Phase 3: Recover Credentials and Load Additional Code

The web shell’s ‘S’ command reads Windchill’s ieStructProperties.txt configuration file and uses the application’s keystore functions to decrypt what it finds. The recovered values include the LDAP manager password along with administrative, object-storage, and site-administrator credentials [T1555].

The implant also accepts a Base64-encoded ZIP of compiled Java bytecode, loads it with a custom class loader, and executes it in memory [T1105]. This gives the operators a path to add functionality without writing a second payload to disk.

Hunt for the behavior: Search for a POST request with the custom HTTP header X-windchill-req carrying a Base64 blob.

Phase 4: Map Windchill’s File Vault From Inside the Application

Windchill separates document metadata from the files stored in its vault. The database stores structural metadata such as file names, storage location, permissions, and stream identifier. The vault stores the actual file content under a system-generated name. The stream identifier reconnects each stored file with its human-readable record.

The implant assists in automating that mapping. Its fl function, backed by its Flst1 class, queries Windchill for vault stream identifiers, filenames, storage paths, and file sizes  [T1213]. This can reach into Windchill tables such as ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem. It writes the results to flst.txt, effectively giving the operator a catalog of the vault. The attacker can identify proprietary CAD files, blueprints, product designs, or other high-value material, making data collection faster and reducing the network volume generated during exfiltration.

The implant performs these queries through Windchill’s own MethodContext and WTConnection classes. As a result, the database sees requests from the expected application server using its authorized service identity. This gives the attacker both efficiency and stealth: the implant can locate valuable files using Windchill’s own context classes while its database activity resembles legitimate application traffic.

Hunt for the behavior: Correlate unusual vault-table queries with web log requests to /Windchill/login/ JSPs from the same window. Search Windchill working directories for flst.txt.

Phase 5: Exfiltrate Data and Pressure Victims

PTC advised defenders to watch for multi-megabyte responses to POST requests targeting JSP files in the Windchill application tier. ReliaQuest also found that the implant compressed its responses with GZIP. The operators move the stolen data through the same web-shell session used for C2 [T1041].

Starting July 20, Ransom-ISAC observed extortion emails sent to hundreds of users inside affected organizations. The messages appeared to come from compromised email accounts, used the subject line “Windchill PDMLink module serious data leak”, and included  contact details tied to Cl0p’s leak site. By August 19, Cl0p had named more than 40 alleged victims and claimed to have stolen databases, engineering documents, blueprints, project files, images, backups, and other corporate data.

Hunt for the behavior: Multi-megabyte or GZIP-compressed POST responses from JSP resources under /Windchill/login/, especially repeated large transfers to the same external peer.

Detect the Behavior: MITRE ATT&CK to ExtraHop Mapping

Defensive Implications and Network Detection Capabilities

The implant succeeds by blending in, using the web and database paths that Windchill is configured for. A rule that looks only for an unknown database account or an unusual source host may miss the vault queries because they come from the legitimate application server under its normal service identity. A signature that inspects only the URL or request body may miss commands hidden in a custom header.

Defenders need to correlate behavior across boundaries. To detect malicious behavior like this look for an external WSDL probe or unusual login-path request, followed by POSTs to a newly observed JSP resource, access to rare vault tables, and a large response to the same external peer.

North-south visibility should cover traffic terminating at the Windchill application. East-West visibility should cover the Windchill-to-database path. In this type of attack, TLS decryption substantially improves visibility coverage because the unique URI and header values sit inside HTTPS. RevealX provides that decryption passively, covering both the north-south path to Windchill and the east-west path to the database. Without decryption, focus on adversary known infrastructure, connections to new peers, session timing, and unexpected response volumes to prioritize investigation.

Key Takeaways

• Cl0p-linked operators exploited CVE-2026-12569 against internet-exposed Windchill and FlexPLM servers, then deployed persistent JSP web shells for remote access and data theft.
• The custom implant used Windchill’s own classes and service identity to decrypt stored credentials and query the application database, making malicious activity resemble normal application traffic.
• The most specific network indicators are the X-windchill-req request header, POST requests to hex-named or dpr_ JSP files under /Windchill/login/, and large compressed responses from those resources.

Recommended Defensive Actions

• Apply PTC’s current fixes and mitigations, then verify that unsupported or overlooked Windchill/FlexPLM instances are not exposed to the internet.
• Hunt back to early June 2026 for the documented WSDL probe, all published JSP path patterns, the custom request header, known IP addresses, and large responses from JSP files.
• Search the Windchill web root and working directories for unexpected JSP files, flst.txt, and the structural Java behaviors documented in Ransom-ISAC’s YARA rule.
• If compromise is suspected, assume credentials stored in the Windchill keystore were exposed. Rotate LDAP manager, administrative, site, database, and object-storage credentials, then investigate their use from new devices or services.
• Restrict unnecessary outbound access from the Windchill tier and monitor new destinations, unusual transfer sizes, and unexpected access from Windchill to directory or storage services.

Resources

PTC: Customer & Partner Updates: Remote Code Execution Vulnerability in PTC’s Windchill and FlexPLM Solutions

SecurityWeek: First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild

ReliaQuest: Clop Returns with Custom Implant in Mass-Extortion Campaign,

Ransom-ISAC: Cl0p Exploitation of PTC Windchill & FlexPLM (CVE-2026-12569)

SecurityWeek: PTC Windchill Vulnerability Exploited in Ransomware Campaign

SecurityWeek: Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign

CPO Magazine: Clop Ransomware Gang Breaches 50+ Organizations, Including GE, Philips, and Shell

BleepingComputer: Clop Created Custom Web Shell for Windchill Data Theft Attacks