Clop-Linked Custom Web Shell Targets PTC Windchill

Overview

• ReliaQuest published a technical analysis on August 18 that identified a bespoke JavaServer Pages (JSP) web shell built to run inside Windchill and FlexPLM processes.
• The implant uses Windchill classes to connect to the application database, decrypt keystore entries including the LDAP manager password, and write file lists for exfiltration.
• The web shell accepts commands via a custom eight-character X-windchill-req HTTP header to decrypt secrets, enumerate vault tables (ApplicationData, FVITEM, FVMOUNT, MasteredOnReplicaItem), read files, and load additional Java code.
• Multiple signals including extortion emails and Ransom-ISAC reporting tie the activity to the Clop extortion gang, which has a history of mass exploitation of file-transfer and file-sharing platforms.
• PTC released fixes for CVE-2026-12569 on June 17 and CISA added the flaw to its Known Exploited Vulnerabilities list; ReliaQuest urges immediate patching, searching for unusual JSPs that reference X-windchill-req, rotating Windchill credentials, and treating suspected hosts as compromised.