Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign

Summary

The Cl0p ransomware group has publicly named over 40 organizations as victims of a campaign exploiting a vulnerability in PTC's Windchill and FlexPLM platforms. The attackers used a custom implant to steal sensitive data, including project files, blueprints, and corporate documents, ranging from 1GB to several terabytes per victim. This campaign follows Cl0p's previous data theft operations targeting other software vulnerabilities.

Full text

The Cl0p ransomware group has named more than 40 organizations allegedly targeted in the recent campaign that exploited a vulnerability in PTC’s product lifecycle management (PLM) platforms Windchill and FlexPLM. The vulnerability and its exploitation The exploitation of the vulnerability, tracked as CVE-2026-12569, came to light in June, when CISA added it to its KEV catalog and the vendor warned of attacks targeting it. The flaw is an improper input validation issue that allows a remote, unauthenticated attacker to achieve arbitrary code execution via specially crafted requests. Exploitation of the vulnerability was expected, with police in Germany reportedly alerting organizations about imminent attacks. It’s worth noting that CVE-2026-12569 is the first ever Windchill vulnerability to be exploited in the wild. The cybersecurity industry reported seeing exploitation of the PLM product flaw in Cl0p ransomware attacks in late July. Cl0p affiliates exploited the security hole to deliver web shells that gave them access to the data of organizations using Windchill.Advertisement. Scroll to continue reading. Security firm ReliaQuest reported on Tuesday that Cl0p has been using a custom implant designed to provide “full data theft capability” without requiring additional tools. “[The web shell] maps sensitive vault data, decrypts every credential in the Windchill keystore, and includes a custom Java class loader that lets Clop execute any additional code inside the application process, extending the shell into an unlimited backdoor for follow-on activity such as lateral movement, ransomware, or persistence,” ReliaQuest explained. Cl0p attacks The Cl0p cybercrime gang initially only listed partial company names on its website, but on August 12 it started releasing alleged victims’ full names. More than 40 organizations apparently targeted in the Windchill campaign have been named to date. For each victim, the hackers listed the type and amount of information they have stolen. The type of exfiltrated data includes databases, project files, backups, photographs and other image files, engineering documents, blueprints, diagrams, logs, and other corporate documents. The amount of stolen information per organization ranges between 1 GB and several terabytes, according to the hackers. The compromised files could contain sensitive personal information and valuable intellectual property, but much of it may be of little value and already in the public domain, which is why many of the targeted organizations have likely refused to pay a ransom. The list of alleged victims includes oil and gas giant Shell, tech giant Philips, fintech giant Fiserv, enterprise mobility provider Zebra Technologies, industrial equipment manufacturer Ingersoll Rand, point-of-sale software maker Toast, global medical technology leader Mindray, and key Apple camera lens supplier Largan Precision. GE was initially listed as well, but it has since been removed from the Cl0p website, which could indicate that the company has agreed to pay a ransom or has resumed negotiations with the hackers. Companies such as Shell, Philips, Fiserv and GE stated that they are aware of the claims and are investigating, but none has confirmed a significant data breach. Cl0p previously conducted similar data theft and extortion campaigns targeting vulnerabilities in Oracle E-Business Suite, MOVEit, Cleo, and GoAnywhere software. Related: CareCloud Data Breach Impact Grows to 3.7 Million Individuals Related: Heights Finance Data Breach Impacts at Least 1.2 Million Individuals Related: 680,000 Impacted by French Tax Authority Data Breach Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Fortinet Acquires AI Security Company Virtue AIIrregular Details How a Naming Error Let AI Models Attack a Real Company Conflicting Test Goals Pushed Claude Agents to Deploy Self-Replicating MalwareCritical SAP Commerce Cloud Vulnerability Exploited 3 Days After DisclosureGoogle Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness GoalOver 1,000 Charities Hit by Beacon CRM Data BreachCybersecurity M&A Roundup: 21 Deals Announced in July 2026White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs Latest News US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of ThemCISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities943 Patches Rolled Out With Oracle’s August 2026 Security UpdateChrome, Firefox Updates Patch Dozens of VulnerabilitiesCareCloud Data Breach Impact Grows to 3.7 Million IndividualsWebinar Today: Rethinking Cyber Defense for AI-Speed AttacksCISO Conversations: Nico Waisman – From Self-Taught Hacker to AI-Driven Offensive Security at XBOWAI-Driven Vulnerability Surge Breaks the Traditional Patching Model Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveDali Rajic is joining OpenAI as Chief Revenue Officer.Erika Dean has been appointed Chief Information Security Officer at Tricentis.C1 has named Jeff St. Clair Chief Revenue Officer.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-12569

Entities