Clop Hits PTC Windchill and FlexPLM Through Critical Vulnerability

The Clop gang (also known as Cl0p) has launched a new data-theft campaign targeting internet-exposed instances of PTC Windchill and FlexPLM. The activity was reported by ReliaQuest.

The Vulnerability and the Attack Technique

The attackers are exploiting a critical vulnerability, CVE-2026-12569 — an insecure deserialization flaw rated 9.3 on the CVSS scale. It allows an unauthenticated attacker to execute arbitrary code on vulnerable systems. Once inside, the operators deploy JSP web shells, which they use to run commands and exfiltrate confidential product data belonging to the victim companies.

According to ReliaQuest, the attacks cannot yet be definitively attributed, but the observed tradecraft matches previous Cl0p campaigns against enterprise applications and repositories of valuable data. As BleepingComputer discovered, companies have already begun receiving extortion emails from the address support@cryptohox.com — one of the gang's new addresses. Switching email addresses ahead of a new campaign is a typical Clop tactic.

The Response from the Vendor and Regulators

PTC began releasing patches for CVE-2026-12569 back on June 17. The company did not confirm exploitation “in the wild,” but in a private bulletin it urged customers to check their environments for indicators of compromise. After PTC's June 26 warning about “heightened threat activity,” CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and required U.S. federal agencies to close the gaps within three days.

According to the German outlet Heise, Germany's Federal Office for Information Security (BSI) acted no less decisively: staff called and emailed PTC customers in the dead of night, urging them to install the updates as soon as possible. A similar sense of urgency was seen back in March, when the issue was a comparable critical vulnerability, CVE-2026-4681.

ReliaQuest recommends not only installing the patches but also, where possible, placing the systems behind a VPN or trusted access gateways. If compromise is suspected, it advises isolating the servers, collecting forensic artifacts, and rotating all compromised credentials before restoring operations.

Why It Matters

Windchill and FlexPLM belong to the class of PLM (Product Lifecycle Management) systems — they support a product from concept through to mass production. These platforms are used by engineering, manufacturing, and logistics teams in the aerospace, defense, and automotive industries, as well as in heavy machinery, retail, and medtech. PTC claims more than 30,000 customers worldwide.

Clop has a rich history of breaching enterprise platforms: Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U, Cleo, and MOVEit Transfer — the last of these attacks affected more than 2,770 organizations. More recently, the gang used a zero-day vulnerability in Oracle EBS to steal data from numerous companies, including Harvard University, The Washington Post, Logitech, Estée Lauder, and Korean Air. Clop publishes the stolen data on its leak site and distributes it via torrents if a victim refuses to pay. The U.S. State Department is offering a reward of up to $10 million for information linking the gang to a foreign government.

Source: Bleeping Computer