Cl0p Affiliates Exploit PTC Windchill Flaw for Unauthenticated RCE Attacks
Threat actors affiliated with the Cl0p ransomware operation—tracked under aliases including Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest—are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a fresh data extortion campaign. According to a coordinated advisory issued by Ransom-ISAC alongside eCrime.ch and DEFUSED, attackers are chaining a pre-authentication information disclosure flaw in the FlexPLM WSDL endpoint with a server-side vulnerability in the Windchill login servlet to achieve unauthenticated remote code execution. Once inside, the operators deploy hex-named JSP web shells under the /Windchill/login/ directory, then pivot to file system enumeration and staging of engineering and design data for double extortion theft.
The exploitation hinges on CVE-2026-12569, a critical vulnerability in PTC Windchill carrying a CVSS v3.1 score of 9.3, which was added to CISA's Known Exploited Vulnerabilities (KEV) catalog in June 2026. PTC confirmed it has "received continued reports of heightened threat activity," warning that unknown attackers are leveraging the flaw to drop JSP web shells against unpatched systems. Researchers Brandon Parsons, Corsin Camichel, and Simo Kohonen noted that the RCE is chained with a separate pre-authentication information-disclosure defect in the FlexPLM WSDL endpoint (CVSS 7.5) to enable full unauthenticated exploitation. ReliaQuest corroborated the activity on X, reporting that the tradecraft shares strong characteristics with prior Cl0p campaigns targeting enterprise applications and high-value data repositories. Organizations can use a port scanner to identify exposed Windchill instances and verify whether their deployments are reachable from the public internet.
Victims span the manufacturing, automotive, aerospace, and retail sectors—industries heavily reliant on PTC's product lifecycle management platforms. Ransom-ISAC has shared four IP indicators of compromise matching those published by PTC: 216.152.148.54, 216.152.151.204, 104.243.35.63, and 5.180.41.35. The extortion phase is particularly aggressive: emails are dispatched from previously compromised accounts to hundreds of users within a single organization, embedding instructions for contacting the Cl0p crew directly. The incident underscores why security teams should run a privacy checkup on exposed infrastructure and audit outbound email flows for signs of account takeover.
The Cl0p gang has a documented history of weaponizing flaws in widely deployed enterprise products to facilitate mass data theft and extortion. Previous operations have exploited file transfer solutions from Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer, as well as a vulnerability in Oracle E-Business Suite. Given this pattern, defenders are urged to apply PTC's patches immediately, hunt for the published IoCs across network and endpoint telemetry, and validate certificate configurations on exposed Windchill servers using an SSL/TLS checker to ensure encrypted channels have not been silently downgraded by the attackers.