Cl0p Hackers Exploit Critical PTC Windchill CVE-2023-XXXX to Steal Data

Key Takeaways

• The Cl0p ransomware gang is actively exploiting a critical remote code execution vulnerability (CVE-2026-12569) in PTC Windchill servers.
• This attack targets manufacturing organizations, aiming to steal sensitive product designs, engineering files, and administrative credentials.
• A custom web shell, specifically designed for Windchill, is deployed to facilitate data exfiltration and broader network compromise.
• The vulnerability carries a CVSS severity rating of 9.3 (Critical). Organizations must apply PTC’s fix immediately and implement robust detection strategies.

Cl0p Returns with Targeted Attacks on PTC Windchill Servers

The notorious Cl0p ransomware group, also identified as Cl0P, has launched a new campaign targeting PTC Windchill servers, a critical product lifecycle management (PLM) system used by manufacturers. This latest offensive places sensitive engineering data, stored passwords, and proprietary company records at severe risk of theft and subsequent extortion.

The financially motivated threat actor is leveraging a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-12569, to infiltrate exposed Windchill systems. Upon successful exploitation, Cl0p deploys a custom-built web shell, meticulously crafted to operate within the Windchill environment, enabling comprehensive data exfiltration and potential lateral movement within victim networks.

PTC Windchill is widely adopted by manufacturers to manage product designs, bills of materials, and related engineering data throughout a product’s lifecycle. A successful breach of these systems allows attackers to quickly identify and exfiltrate highly valuable intellectual property, subsequently using the threat of public release to pressure affected organizations into paying a ransom.

This operation aligns with Cl0p’s established modus operandi of exploiting vulnerabilities in widely used business software at scale, a strategy previously observed in earlier attacks targeting Windchill servers and other enterprise platforms.

Custom Web Shell Facilitates Deep Compromise

ReliaQuest said in a report shared with Cyber Security News (CSN) that their researchers identified the sophisticated web shell and concluded with high confidence that the activity is linked to Cl0p. This implant is far more advanced than a basic command prompt, equipped with capabilities for credential theft, comprehensive file discovery, efficient file transfers, and the execution of additional arbitrary code.

The presence of such a tailored web shell highlights how a compromise of a single internet-facing application can rapidly escalate into a widespread network incident. Stolen directory or administrator credentials can unlock access to a multitude of other critical systems, including email services, virtual private networks (VPNs), databases, and other applications that rely on the same authentication mechanisms. Consequently, the threat extends beyond the data residing within Windchill itself to encompass the broader network infrastructure accessible via those credentials. This campaign underscores the imperative to treat engineering platforms as exceptionally high-value targets requiring stringent security measures.

Exploitation Details and Attack Chain

The attack sequence commences with the exploitation of CVE-2026-12569 on an exposed Windchill server. ReliaQuest assigned this vulnerability a critical CVSS severity rating of 9.3. The resulting web shell is intricately designed to interact with Windchill’s internal architecture. It possesses the ability to read application configuration files, query the underlying database, decrypt stored secrets, and prepare sensitive information for exfiltration without the need for additional tools to be deployed on the server.

A significant feature of this web shell is its capacity to retrieve the application’s directory management and administrative credentials in a readily usable format. These credentials are particularly potent, as directory accounts frequently govern access across an entire enterprise. This aspect of the intrusion mirrors recent Cl0p ransomware operations, where the exploitation of a trusted platform provides a gateway to broader extortion opportunities.

The implant also meticulously maps Windchill’s file vaults. By leveraging internal database information, it compiles a list of file names, locations, sizes, and identifiers. This capability provides the Cl0p group with a streamlined method to select and exfiltrate critical engineering drawings, product plans, and other intellectual property from the compromised environment.

Further enhancing the attackers’ flexibility is a built-in Java class loader. This feature allows the web shell to accept a compressed package of code and execute it directly within the Windchill process memory, thereby minimizing the creation of additional files on disk that could trigger detection. ReliaQuest cautioned that this functionality could support deeper network penetration, establish long-term persistence, or facilitate encryption activities following the initial data theft.

What You Should Do

• Apply Patches Immediately: Organizations must apply PTC’s fix for CVE-2026-12569 without delay.
• Limit Public Exposure: Restrict public exposure of Windchill management interfaces. Consider placing the service behind a web application firewall (WAF) or a reverse proxy.
• Monitor Logs and Files: Regularly review Windchill logs for any signs of exploit attempts. Actively search for unexpected Java Server Pages (JSP) files within Windchill codebase directories. Investigate any files with recent modifications or those referencing the custom HTTP header (X-windchill-req) and internal Windchill classes.
• Rotate Credentials: If a compromise is confirmed or suspected, immediately rotate the LDAP manager password and all credentials stored in the Windchill keystore. Subsequently, review where these credentials may have been reused across other systems.
• Terminate Active Sessions: End all active sessions linked to any exposed accounts.
• Review Indicators of Compromise (IoCs):
  • SHA-256 hash: 321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf (Hash of Clop’s custom web shell)
  • IP addresses associated with exploitation:
    • 5.180.41[.]35
    • 78.128.113[.]10
    • 104.194.9[.]14
    • 104.243.35[.]63
    • 185.227.83[.]236
    • 209.222.98[.]44
    • 216.152.151[.]204

  (Note: IP addresses and domains are intentionally defanged to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.)

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.