Clop Develops Custom Web Shell for Attacks on PTC Windchill

The Clop cybercriminal group continues to expand its arsenal of tools for targeting corporate systems. This time, experts at ReliaQuest discovered a specialized web shell designed to compromise PTC Windchill and FlexPLM servers. Unlike generic tools, this shell leverages deep knowledge of Windchill’s internal architecture, including APIs, database structures, and file storage mechanisms.

The attacks exploit the critical vulnerability CVE-2026-12569, which allows remote execution of arbitrary code. The web shell, written in JavaServer Pages (JSP), integrates with Windchill classes such as MethodContext and WTConnection, enabling attackers to execute database queries under the guise of the application itself. This complicates detection, as the activity mimics legitimate processes.

The tool supports several commands for data theft, including decrypting LDAP credentials, enumerating files in storage, and extracting them. For example, the "S" command provides access to LDAP configuration and decrypts passwords, while the "L" command lists files in storage and saves them to flst.txt for subsequent download. The shell also allows uploading and executing additional Java code in the Windchill process memory.

ReliaQuest notes that Clop’s attacks on Windchill are a logical extension of its campaign against corporate file-sharing platforms like MOVEit Transfer and GoAnywhere MFT. In July of this year, the group launched mass attacks on vulnerable Windchill servers, sending ransom demands to hundreds of employees at affected organizations. PTC began releasing patches for the vulnerability in June, and CISA has since added it to its catalog of actively exploited vulnerabilities.

Experts recommend that companies using Windchill immediately apply patches, scan servers for suspicious JSP files, and reset all credentials associated with the system. Special attention should be given to files containing the X-windchill-req header, which is used to control the web shell.