Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

Industrial Software Under Active Attack

Threat actors affiliated with the Cl0p ransomware group (also tracked as Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) are actively exploiting critical vulnerabilities in PTC Windchill and FlexPLM — widely deployed product lifecycle management (PLM) and supply chain software used across manufacturing, aerospace, defence, and industrial sectors.

The attacks chain a pre-authentication information disclosure flaw with a subsequent remote code execution injection vulnerability, granting attackers full system access without any credentials. Organizations with internet-exposed instances are urged to take immediate action.

Attack Overview

Vulnerability Chain

Cl0p affiliates are exploiting a two-stage vulnerability chain:

Stage 1: Pre-Auth Information Disclosure
├── Attacker sends unauthenticated request to exposed Windchill/FlexPLM endpoint
├── Application discloses internal configuration data, file paths, or session tokens
└── Attacker harvests disclosed information to prepare Stage 2
 
Stage 2: Remote Code Execution Injection
├── Attacker uses disclosed information to craft a targeted RCE payload
├── Injection executed against the vulnerable endpoint
├── Full code execution achieved on the server without authentication
└── Attacker establishes persistent access for data exfiltration

Campaign Characteristics

About the Targeted Software

PTC Windchill

Windchill is one of the world's most widely deployed PLM platforms, used by major manufacturers to manage product data, engineering documents, BOM structures, and supply chain information. An internet-exposed Windchill instance that is compromised gives attackers access to highly sensitive intellectual property.

FlexPLM

FlexPLM is PTC's product lifecycle management platform targeting retail, apparel, and consumer goods companies. It manages design specifications, sourcing data, and supply chain workflows. Breaches can expose trade secrets, supplier agreements, and customer data.

Cl0p's Exploitation Pattern

Cl0p has a well-documented history of mass-exploitation campaigns targeting internet-facing enterprise software:

• 2023: MOVEit Transfer — exploited CVE-2023-34362, affecting hundreds of organizations globally
• 2024: Cleo file transfer software — mass exploitation campaign
• 2026: PTC Windchill and FlexPLM — current active campaign

The group's methodology has shifted increasingly toward data theft and extortion rather than ransomware encryption. Data is exfiltrated and organizations are threatened with public exposure on Cl0p's dark web leak site.

Immediate Actions Required

Step 1: Assess Your Exposure

Immediately determine whether your Windchill or FlexPLM instances are internet-accessible:

# Check if Windchill web services are publicly accessible
# (run from outside your network or via an external scanner)
curl -I https://your-windchill-instance.com/Windchill/
 
# Review your firewall rules and network segmentation
# Windchill default ports: 80, 443, 7001 (WebLogic)
# FlexPLM default ports: 80, 443, 8080

Step 2: Remove Internet Exposure Immediately

If your PLM instance is internet-accessible and no business requirement demands it:

1. Place behind a VPN — require VPN authentication before accessing the application
2. Restrict to known IP ranges — firewall all access to corporate IP ranges
3. Deploy a WAF — use a web application firewall to filter and inspect traffic
4. Disable unused web services — reduce attack surface by disabling features not in use

Step 3: Apply Available Patches

Check the PTC Support Portal for:

• Windchill security patches related to pre-auth information disclosure
• FlexPLM security updates addressing RCE vulnerabilities
• Apply all available patches immediately

Step 4: Investigate for Compromise

If your instance was internet-accessible:

# Review web server access logs for exploitation indicators
# Look for unexpected requests to authentication bypass patterns
grep -E "(\.\.\/|%2e%2e|null\+|%00|eval\(|exec\()" /path/to/windchill/access.log
 
# Check for unexpected processes spawned by the web server
ps aux | grep -E "(windchill|flexplm)" 
 
# Audit for newly created or modified files
find /path/to/windchill/install -newer /path/to/windchill/install/version.txt -type f

Detection Indicators

Cl0p's Extortion Methodology

Unlike traditional ransomware groups, Cl0p in recent campaigns:

1. Gains access and enumerates file shares and databases
2. Exfiltrates sensitive documents, IP, and business data
3. Does not encrypt systems (minimizing detection, maximizing operational impact on victim)
4. Contacts victims with extortion demands
5. Publishes data on their Tor-based leak site if payment is refused

Organizations affected should engage an incident response firm immediately and consider legal counsel before any response to extortion demands.

Sector-Specific Concerns

For organizations in affected sectors, the potential data exposed includes:

• Manufacturing: CAD files, BOM data, manufacturing process specifications
• Aerospace/Defence: ITAR-controlled technical data, program details
• Automotive: Supplier contracts, design specifications, quality records
• Retail/Apparel (FlexPLM): Design IP, sourcing agreements, customer specifications

Exposure of ITAR-controlled data carries additional regulatory reporting obligations beyond standard breach notification.

References

• The Hacker News — Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM
• PTC Security Advisories
• CISA Known Exploited Vulnerabilities Catalog

Related Reading

• ShinyHunters Data Leaks Fuel $2,000 Sextortion Email Scam
• CVE-2026-56163: Critical Auth Bypass in Azure Kubernetes Service
• CVE-2026-57106: Critical SSRF in SAP Data Quality