Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

Clop ransomware operators deployed a custom JSP web shell targeting PTC Windchill and FlexPLM servers, exploiting CVE-2026-12569 to decrypt stored credentials and exfiltrate engineering data. Any organization running vulnerable Windchill instances is at immediate risk of credential compromise, lateral movement, and enterprise-wide breach. The shell provides attackers direct access to proprietary designs, source code, and administrative credentials including LDAP passwords.