Full Report
Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. "Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling
Analysis Summary
# Incident Report: Cl0p Exploitation of PTC Windchill and FlexPLM
## Executive Summary
Threat actors affiliated with the Cl0p ransomware group are actively exploiting critical vulnerabilities in internet-exposed PTC Windchill and FlexPLM software. By chaining a pre-authentication information disclosure flaw with a server-side remote code execution (RCE) vulnerability, attackers are deploying web shells to exfiltrate sensitive engineering and design data for double-extortion purposes.
## Incident Details
- **Discovery Date:** July 2026 (CISA KEV addition in June 2026)
- **Incident Date:** Ongoing/Active as of July 2026
- **Affected Organization:** Multiple (Unspecified)
- **Sector:** Manufacturing, Automotive, Aerospace, and Retail
- **Geography:** Global (Internet-exposed deployments)
## Timeline of Events
### Initial Access
- **Date/Time:** Commencing late June/early July 2026
- **Vector:** Vulnerability Chaining (CVE-2026-12569 and FlexPLM WSDL defect)
- **Details:** Attackers exploit a pre-authentication information disclosure in the FlexPLM WSDL endpoint to facilitate the exploitation of a server-side flaw in the Windchill login servlet.
### Lateral Movement
- **Web Shell Deployment:** Persistent access is established via hex-named JSP web shells located in `/Windchill/login/`.
- **Command Execution:** Attackers use the web shells to execute remote commands and pivot within the environment.
### Data Exfiltration/Impact
- **Staging:** Attackers conduct file system enumeration to identify high-value engineering and design data.
- **Extortion:** Data is exfiltrated for double-extortion; hundreds of employees receive extortion emails from compromised internal accounts or Cl0p-controlled addresses.
### Detection & Response
- **Discovery:** Detected through threat intelligence monitoring (eCrime.ch, Ransom-ISAC, ReliaQuest) and heightened activity reports received by PTC.
- **Response Actions:** CISA added CVE-2026-12569 to the Known Exploited Vulnerabilities (KEV) catalog. PTC released emergency advisories and patches.
## Attack Methodology
- **Initial Access:** Unauthenticated Remote Code Execution (RCE) via vulnerability chaining.
- **Persistence:** Deployment of hex-named JSP web shells in the Windchill login directory.
- **Privilege Escalation:** Exploitation of server-side flaws to run code under the context of the application service.
- **Defense Evasion:** Use of legitimate-looking JSP shells and compromised internal accounts for extortion emails.
- **Discovery:** File system enumeration and searching for sensitive engineering/product design repositories.
- **Lateral Movement:** Web shell-based remote command execution.
- **Collection:** Staging of sensitive manufacturing and design data.
- **Exfiltration:** Transfer of data to attacker-controlled infrastructure.
- **Impact:** Double extortion (data theft and public leak threats).
## Impact Assessment
- **Financial:** High potential for loss through extortion payments and intellectual property theft.
- **Data Breach:** Compromise of sensitive product designs, aerospace engineering data, and automotive IP.
- **Operational:** Potential disruption of manufacturing PLM (Product Lifecycle Management) workflows.
- **Reputational:** High impact due to the leakage of proprietary client/partner design data.
## Indicators of Compromise
- **Network Indicators:**
- 216[.]152[.]148[.]54
- 216[.]152[.]151[.]204
- 104[.]243[.]35[.]63
- 5[.]180[.]41[.]35
- **File Indicators:** Hex-named `.jsp` files located in `/Windchill/login/`.
- **Behavioral Indicators:** Unauthenticated requests to FlexPLM WSDL endpoints followed by unexpected POST requests to the Windchill login servlet.
## Response Actions
- **Containment:** Identify and isolate internet-facing PTC Windchill/FlexPLM servers.
- **Eradication:** Delete unauthorized JSP web shells and patch systems to the latest secure version of PTC Windchill.
- **Recovery:** Audit file systems for staged data and reset credentials for accounts used in the extortion phase.
## Lessons Learned
- **Vulnerability Chaining:** Defending against single vulnerabilities is insufficient; attackers are increasingly using "low-severity" info-disclosure flaws to enable "critical" RCEs.
- **Supply Chain Risks:** PLM software contains the "crown jewels" of manufacturing firms and remains a primary target for specialized extortion groups like Cl0p.
- **Exposure:** Critical business logic and login servlets should not be exposed to the public internet without additional layers of protection (VPN, WAF with virtual patching).
## Recommendations
- **Immediate:** Patch CVE-2026-12569 and related FlexPLM vulnerabilities immediately.
- **Network:** Restrict access to Windchill and FlexPLM interfaces to authorized IP ranges or via internal VPN only.
- **Monitoring:** Implement file integrity monitoring (FIM) on web server directories (`/Windchill/login/`) to detect unauthorized web shell creation.
- **EDR:** Deploy Endpoint Detection and Response on application servers to flag suspicious child processes (e.g., `cmd.exe` or `/bin/sh` spawned by a web server process).