Clop Ransomware Targets PTC Windchill and FlexPLM in Mass Data Theft Campaign

The Clop ransomware gang (also tracked as Cl0p) has launched a new mass exploitation campaign targeting PTC Windchill PDMLink and FlexPLM installations exposed to the internet, leveraging a critical unauthenticated remote code execution vulnerability to steal sensitive product data and threaten extortion.

The Vulnerability: CVE-2026-12569

At the center of the campaign is CVE-2026-12569, a critical unsafe deserialization flaw affecting both Windchill PDMLink and FlexPLM. The vulnerability carries a CVSS v3.1 score of 9.8 (Critical) and PTC's own CVSS v4.0 assessment of 9.3 Critical.

The flaw requires no authentication and no user interaction — an attacker can send a crafted request to an exposed instance and achieve full remote code execution immediately. It is classified under CWE-502 (Deserialization of Untrusted Data) and CWE-20 (Improper Input Validation).

Affected versions include:

• Windchill PDMLink: 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0–13.1.3.0
• FlexPLM: 11.1 M020, 11.2.1.0, 12.0.0.0–12.0.2.0, 12.1.2.0–12.1.3.0, 13.0.2.0–13.0.3.0

How Clop is Exploiting It

Clop operators are deploying JSP webshells on internet-facing PTC instances to gain persistent remote command execution, then pivoting to exfiltrate sensitive business and product data. The attack chain requires no credentials — once a system is identified via Shodan or similar reconnaissance, exploitation is straightforward.

Approximately 104 internet-exposed Windchill instances have been identified via Shodan, concentrated heavily in the United States (98 instances), with additional exposure in Australia, France, South Korea, the Netherlands, Portugal, and Slovakia. A significant share are hosted on Amazon Web Services infrastructure.

PTC's total customer base spans more than 30,000 organizations globally, and FlexPLM alone serves over 1,500 brand and retail customers in apparel and footwear.

Targeted Industries

The industries in Clop's crosshairs reflect the PLM user base:

• Aerospace and defense
• Automotive
• Heavy machinery and industrial manufacturing
• Retail and fashion (FlexPLM is the dominant platform for apparel/footwear PLM)
• Medical devices and medtech

In the context of product lifecycle management platforms, "sensitive product data" means engineering designs, product blueprints, bills of materials, intellectual property, and supply chain configuration data — exactly the category of information that commands serious extortion leverage.

Clop's Extortion Playbook

Clop does not deploy ransomware encryption in these campaigns — this is pure data theft extortion. The gang uses previously compromised email accounts to contact hundreds of employees within each targeted organization, providing contact information and demanding payment.

Victims who don't pay have their data published on Clop's dark web leak site and made available for download via Torrent. This is the same methodology Clop used in their Oracle EBS campaign, which claimed victims including Harvard University, The Washington Post, GlobalLogic, and Korean Air.

Timeline

Government Response

CISA added CVE-2026-12569 to the Known Exploited Vulnerabilities (KEV) catalog and ordered federal agencies to secure affected systems within three days under BOD 26-04. Germany's BSI conducted emergency outreach to affected organizations via email and phone.

What Organizations Should Do

If your organization runs Windchill PDMLink or FlexPLM:

1. Apply PTC patches immediately — reference support article CS473270 for patch and mitigation instructions
2. Remove direct internet exposure — place instances behind a VPN or trusted access gateway
3. Isolate affected servers immediately if compromise is suspected
4. Rotate all exposed credentials before restoring service
5. Hunt for JSP webshells on affected systems — check web directories for suspicious .jsp files with unusual names or timestamps

Clop's Pattern

Clop has now run this playbook across a remarkable list of enterprise file transfer and business application vulnerabilities: Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U, Cleo, MOVEit Transfer (2,770+ organizations), Oracle EBS, and now PTC PLM. The pattern is consistent — find a critical unauthenticated RCE in a widely deployed enterprise platform, mass-exploit before patches are applied, steal data, and threaten publication.

The window between patch release (June 17) and confirmed active exploitation (July 24) is roughly five weeks — more than enough time to patch, but clearly insufficient for a significant portion of exposed organizations. If your PLM instance is internet-facing and unpatched, treat it as already compromised pending forensic review.

Sources: BleepingComputer, CISA KEV Catalog, ReliaQuest, Ransom-ISAC