# Cl0p Is Back — and This Time It's After Your CAD Files


## The Threat


PTC Windchill and FlexPLM run the product lifecycle management infrastructure for some of the world's most sensitive manufacturers. They store CAD models, engineering specs, design histories, and supplier data — the kind of intellectual property that rivals and nation-states would pay handsomely to obtain. Cl0p, the ransomware group that turned enterprise file-transfer software into a years-long gold mine, has now trained its sights on these systems.


According to a coordinated advisory published by Ransom-ISAC, eCrime.ch, and DEFUSED, attackers linked to Cl0p are chaining two separate vulnerabilities to achieve unauthenticated remote code execution on internet-exposed Windchill deployments. The attack sequence starts with a pre-authentication information disclosure bug in FlexPLM's WSDL endpoint, which feeds into a server-side flaw in the Windchill login servlet. The result: full RCE without a single valid credential, followed by JSP web shell deployment under /Windchill/login/. ReliaQuest has independently confirmed active exploitation in the wild.


Once inside, attackers conduct methodical file system enumeration, identify and stage high-value engineering and design data, and proceed with double extortion — exfiltrating the data before threatening to publish it. Extortion emails are broadcast to hundreds of employees within a compromised organization, sent from previously-hijacked accounts to maximize pressure. The targeting profile is unambiguous: manufacturing, automotive, aerospace, and retail companies with PLM infrastructure reachable from the public internet.


## Severity and Impact


| CVE | CVSS Score | Severity | Vector | Attack Complexity | Auth Required | CWE |

|-----|-----------|----------|--------|-------------------|---------------|-----|

| CVE-2026-12569 (Windchill login servlet RCE) | 9.3 | Critical | Network | Low | None | CWE-94 (Code Injection) |

| FlexPLM WSDL info disclosure (no CVE assigned) | 7.5 | High | Network | Low | None | CWE-200 (Exposure of Sensitive Information) |


CVE-2026-12569 was added to CISA's Known Exploited Vulnerabilities catalog late last month. PTC has acknowledged "continued reports of heightened threat activity" against susceptible systems.


## Affected Products


PTC Windchill

  • All internet-exposed Windchill deployments running versions vulnerable to CVE-2026-12569
  • Attack vector: Windchill login servlet (/Windchill/login/)

    • PTC FlexPLM

  • Internet-exposed FlexPLM instances with accessible WSDL endpoint
  • Used as the entry point for pre-authentication information disclosure that enables chaining to Windchill RCE

    • PTC has not publicly specified which exact version numbers are patched vs. vulnerable — consult the vendor advisory directly and verify your installed build.


    ## Mitigations


    Immediate actions:


  • Apply PTC's patches for CVE-2026-12569 immediately; check PTC's support portal for the applicable update for your Windchill version
  • Remove Windchill and FlexPLM from direct internet exposure — neither product is designed to be a public-facing web application; put them behind a VPN or zero-trust gateway
  • Block the confirmed IoCs at your perimeter:

    • - 216.152.148.54

    - 216.152.151.204

    - 104.243.35.63

    - 5.180.41.35

  • Hunt for existing compromise — check for hex-named .jsp files under /Windchill/login/; any file with a randomized hex filename in that directory should be treated as a web shell until proven otherwise
  • Audit FlexPLM WSDL endpoint accessibility — restrict access to the WSDL endpoint at the network layer if you cannot immediately patch
  • Review outbound data flows — Cl0p stages data before exfiltration; look for anomalous bulk reads of engineering file directories and unusual outbound transfers
  • Notify your PLM team and security operations — PTC environments are often managed by engineering teams with limited security tooling; ensure SOC visibility into Windchill logs

    • Network segmentation note: PLM systems should never be reachable from the public internet. If yours is, the patch is necessary but not sufficient — segment it now.


    ## References


  • Ransom-ISAC / eCrime.ch / DEFUSED coordinated advisory (July 2026)
  • PTC security advisory for CVE-2026-12569 — PTC Support Portal
  • CISA Known Exploited Vulnerabilities Catalog — [cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  • ReliaQuest threat intelligence post on active CVE-2026-12569 exploitation

    • ---


    ## HackWire Analysis


    Cl0p's playbook has been remarkably consistent since at least 2021: find a widely-deployed enterprise application that organizations assume is a backend system but have quietly exposed to the internet, exploit a pre-auth or low-friction bug, and steal everything before the victim even knows they're compromised. Accellion. GoAnywhere. MOVEit. Cleo. Each time, the group demonstrates patience — they identify a class of target, find the vulnerability (or buy it), and hit dozens of organizations in a compressed window before defenses catch up.


    What's different here is the data type. Previous Cl0p campaigns targeted file transfer appliances — document repositories and managed file transfer tools. The intellectual property there was sensitive, but generalized. PLM systems like Windchill hold something more specific and more damaging: product engineering data. CAD models, tolerances, proprietary manufacturing processes, supplier specifications, design variants that never shipped. For aerospace and automotive targets, that's not just embarrassing — it's potentially a national security issue and a competitive catastrophe.


    The chaining of two bugs — FlexPLM's WSDL disclosure into Windchill's login servlet — is technically elegant and operationally significant. Neither vulnerability alone may have been sufficient to operationalize at scale; together, they produce reliable unauthenticated RCE. That suggests either prior access to the affected environments for testing, or a sophisticated understanding of how these products integrate in real enterprise deployments. Defenders should not treat this as opportunistic scanning. This is deliberate targeting of an industry vertical.


    The immediate question for security teams in manufacturing and aerospace is simple: does your Windchill or FlexPLM deployment have any path reachable from outside your VPN? If you don't know the answer in under five minutes, assume yes.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)