[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH8BH1qaL7CL44AG0Qo8gS9IXOHJ5Hc4P_SKIuYrkJEs":3},{"article":4,"iocs":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"2b7378c3-3689-48b4-9076-a498389bf72a","Clop created custom web shell for Windchill data theft attacks","clop-created-custom-web-shell-for-windchill-data-theft-attacks-851d3d","A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. [...]","The Clop ransomware gang has been observed deploying a custom Java web shell specifically designed to exploit vulnerabilities in PTC Windchill and FlexPLM servers. This sophisticated implant, analyzed by ReliaQuest, possesses built-in capabilities to decrypt credentials, enumerate file repositories, and exfiltrate sensitive data by leveraging Windchill's internal APIs and database structure. The attacks are believed to be linked to CVE-2026-12569, a critical remote code execution vulnerability for which PTC has released patches.","Clop gang deploys custom Java web shell targeting PTC Windchill servers.","Clop created custom web shell for Windchill data theft attacks By Lawrence Abrams August 18, 2026 01:29 PM 0 A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. Cybersecurity company ReliaQuest analyzed the web shell after it is believed to have been deployed in recent data theft attacks exploiting CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill. ReliaQuest says the implant is not a generic web shell repurposed for the attacks, but was instead built with detailed knowledge of Windchill's internal APIs, database schema, keystore, and file-vault structure. \"This appears to be an application-specific evolution of Clop's established mass-exploitation playbook,\" ReliaQuest said in a report shared with BleepingComputer. The researchers say they found the web shell during the intelligence collection process. The researchers say the activity is likely linked to Clop based on extortion emails containing addresses used on the ransomware gang's data leak site, previously observed X-windchill-req headers also used in the web shell, and TTps commonly used by the threat actors. The Clop extortion gang has a long history of breaching enterprise platforms in data theft attacks, with previous campaigns targeting Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer file-sharing servers, the latter affecting more than 2,770 organizations worldwide. Clop extortion emailSource: Ransom-ISAC As BleepingComputer reported in July, Clop targeted exposed PTC Windchill and FlexPLM servers in a data theft extortion campaign involving exploitation of CVE-2026-12569 and the deployment of JSP web shells. At the time, ReliaQuest said attribution was unconfirmed, but the attacks shared similarities with previous Clop data-theft campaigns targeting secure file-sharing applications. Ransom-ISAC later confirmed Clop activity associated with the attacks, including extortion emails sent to hundreds of employees at affected organizations and containing the gang's latest contact information. PTC began releasing fixes for CVE-2026-12569 on June 17, and CISA later added the vulnerability to its Known Exploited Vulnerabilities catalog following warnings of heightened threat activity. A web shell built specifically for Windchill Analysis by ReliaQuest and BleepingComputer confirms the tool was designed to target Windchill servers rather than act as a generic web shell. The malware is a JavaServer Pages (JSP) web shell that directly imports Windchill-specific classes, including MethodContext, WTConnection, and WTKeyStoreUtil. These classes allow the shell to use Windchill's own functions to access its database, decrypt stored credentials, and locate files stored in application vaults. \"The web shell connects to Windchill's database through the application's own MethodContext and WTConnection classes, meaning its queries run under the application's existing database identity rather than through a separately configured attacker account,\" explains ReliaQuest. \"As a result, database telemetry may attribute this activity to the application's normal service identity, limiting the value of alerts that rely solely on detecting new accounts or unexpected source hosts.\" The web shell is controlled using a custom protocol sent through the HTTP X-windchill-req header, which contains eight characters, with the first character specifying the command and the remaining seven matching a fixed value. Commands supported by the Clop Windchill web shellSource: BleepingComputer The web shell supports the following commands: S – Steal Windchill secrets and configuration: Reads Windchill's LDAP configuration and uses the application's own WTKeyStoreUtil.decryptProperty() function to decrypt the LDAP manager password and other encrypted application data. L – Map Windchill's file vault: Searches Windchill's database for filenames, storage paths, and file sizes. The results are written to a file named flst.txt, which can then be retrieved by the attackers using G command. D – Enumerate directories and retrieve files: Enumerates supplied paths and reads portions of files. G – Read a file: Retrieves the contents of a specified file. R – Delete a file: Deletes a specified file. J – Load and execute additional Java code: Passes a Base64-encoded ZIP archive and loads compiled Java bytecode directly into memory and executes it within the Windchill process. O – Identify the operating system: Returns the operating system name. E – Echo supplied data: Echoes data in the X-windchill-prm header to verify the webshell is responding. ReliaQuest says the web shell's vault enumeration is also designed specifically to query certain tables in Windchill's database. BleepingComputer's analysis shows that these tables are ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem. The cybersecurity company recommends that organizations immediately patch vulnerable Windchill systems and look for unusual JSP files in Windchill directories, especially those containing reference to X-windchill-req. Organizations that suspect their Windchill servers were compromised should also change the LDAP manager password and other Windchill credentials, as they should be considered compromised. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Clop ransomware targets Windchill, FlexPLM in data theft attacksPhilips and GE investigating Clop ransomware data theft claimsShell investigates 'potential incident' after Clop data theft claimsData analyst sent to prison for stealing data, extorting employerWesco confirms security incident after ExfilSquad claims data theft","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fclop-created-custom-web-shell-for-windchill-data-theft-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2022\u002F10\u002F28\u002Fhand-sifting-data.jpg","2026-08-18T17:29:51+00:00","2026-08-18T18:00:30.17189+00:00",9,[18,21,24,26,29],{"name":19,"type":20},"Clop","threat_actor",{"name":22,"type":23},"PTC Windchill","product",{"name":25,"type":23},"FlexPLM",{"name":27,"type":28},"Java web shell","technology",{"name":30,"type":31},"PTC","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"cve","CVE-2026-12569","Vulnerability exploited by Clop for Windchill attacks"]