The Cl0p ransomware and extortion group is reportedly exploiting CVE-2026-12569, a critical remote code execution flaw in PTC Windchill, to deploy a custom web shell built for large-scale data theft.
ReliaQuest Threat Research assessed that the campaign is highly likely linked to Cl0p, also known as Cl0p.
The vulnerability has a CVSS score of 9.3 and affects PTC Windchill, a widely used product lifecycle management platform that stores engineering documents, product designs, and other sensitive intellectual property.
Unlike common web shells that mainly provide remote command execution, this implant is tailored to Windchill’s internal architecture.
It can enumerate file vaults, read files, decrypt credentials stored in the application keystore, and transfer stolen data without needing separate attacker tools.
The activity highlights the serious risk posed by internet-facing enterprise applications holding valuable data.
A compromised Windchill server could expose not only engineering files but also credentials that enable access to connected enterprise services.
Cl0p’s Windchill Data-Theft Webshell
The custom JavaServer Pages (JSP) web shell contains functions specifically designed to abuse Windchill components. One command can retrieve directory-management and administrative credentials stored by the platform.
According to the research, the shell reads Windchill configuration files and decrypts encrypted values from the application keystore.
These may include LDAP manager passwords, administrator credentials, object-storage secrets, and site administrator keys.
The exposure of LDAP credentials is particularly concerning. Such accounts may provide access to Active Directory, email, VPN services, and other systems that rely on centralized directory authentication.
This means a single vulnerable Windchill server could become a stepping stone toward wider enterprise compromise.
The malware also maps Windchill vault data using application-specific database queries. It collects file names, paths, stream identifiers, and file sizes, then creates an inventory that attackers can use to select high-value files for exfiltration.
Rather than connecting to the database with a new attacker-controlled account, the web shell uses Windchill’s existing Java classes and database context.
This allows malicious activity to blend with normal application traffic and makes database-only detection more difficult.
A built-in Java class loader adds another major risk. The feature accepts Base64-encoded Java modules, loads them directly into memory, and executes them inside the Windchill application process.
This approach allows attackers to add new capabilities without changing the original web shell or writing additional payloads to disk.
Potential follow-on activity could include persistence, lateral movement, network discovery, ransomware deployment, or further credential theft.
The shell reportedly receives commands through a custom HTTP header named X-windchill-req and compresses responses with GZIP.
Organizations that do not inspect TLS traffic, log unusual headers, or decompress web responses may miss the activity, ReliaQuest said.
Indicators of Compromise
| IOC Type | Indicator | Description |
|---|---|---|
| SHA-256 Hash | 321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf | Hash of the Cl0p-linked custom PTC Windchill web shell |
| IP Address | 5.180.41[.]35 | Associated with CVE-2026-12569 exp |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
