Key Takeaways
- Threat actors associated with the Cl0p ransomware group are exploiting a critical vulnerability (CVE‑2026‑12569, CVSS 9.3) in PTC Windmill, chaining it with a pre‑authentication information‑disclosure flaw in FlexPLM’s WSDL endpoint (CVSS 7.5) to achieve unauthenticated remote code execution.
- Successful exploitation enables deployment of hex‑named JSP web shells under
/Windchill/login/, allowing attackers to enumerate file systems, stage engineering/design data, and perform double‑extortion data theft. - The campaign primarily targets manufacturing, automotive, aerospace, and retail sectors, with extortion emails sent from compromised accounts to hundreds of users within affected organizations.
- Indicators of compromise (IoCs) include four IP addresses (216.152.148.54, 216.152.151.204, 104.243.35.63, 5.180.41.35) shared by PTC, Ransom‑ISAC, eCrime.ch, and DEFUSED.
- ReliaQuest corroborates the activity, noting the observed tactics resemble prior Cl0p campaigns that have weaponized file‑transfer appliances and Oracle E‑Business Suite vulnerabilities.
- PTC has issued warnings about heightened threat activity and urges customers to apply patches, restrict external exposure of Windmill/FlexPLM services, and monitor for the listed IoCs.
Overview of the Cl0p‑Linked Exploitation Campaign
Since mid‑July 2026, security researchers have observed a coordinated data‑extortion campaign conducted by threat actors tied to the Cl0p ransomware gang (also tracked as Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest). The attackers are focusing on internet‑exposed installations of PTC’s Windmill product lifecycle management (PLM) suite and its companion FlexPLM module. By leveraging two distinct vulnerabilities in these platforms, the threat actors achieve unauthenticated remote code execution (RCE) and subsequently deploy malicious web shells to maintain persistent access.
Technical Details of the Exploited Flaws
The primary flaw being abused is CVE‑2026‑12569, a critical security defect in PTC Windmill carrying a CVSS v3.1 score of 9.3. This vulnerability resides in the Windchill login servlet and allows arbitrary code execution without authentication when successfully triggered. Researchers from Ransom‑ISAC, eCrime.ch, and DEFUSED note that the attackers do not rely on this flaw alone; they chain it with a separate pre‑authentication information‑disclosure defect in the FlexPLM WSDL endpoint (CVSS 7.5). The information leak provides necessary details—such as internal paths and configuration values—that enable the reliable exploitation of the Windmill RCE, culminating in the placement of hex‑named JSP web shells under the /Windchill/login/ directory.
Attack Flow and Post‑Exploitation Activities
Once the web shell is in place, the adversaries gain a foothold that permits them to execute arbitrary commands on the compromised server. Observed post‑exploitation behavior includes systematic file‑system enumeration to locate valuable engineering designs, bill‑of‑materials (BOM) data, and proprietary product specifications. Attackers then stage this sensitive information for exfiltration, employing a double‑extortion model: they threaten to publish the stolen data unless a ransom is paid, while also encrypting files on the victim’s network to increase pressure. The campaign’s focus on high‑value PLM data underscores the attackers’ intent to maximize leverage over manufacturers and related industries.
Industry Sectors Under Siege
The victims identified thus far span several high‑impact verticals. Manufacturing firms—particularly those involved in automotive and aerospace production—are prime targets because their PLM systems store critical design intellectual property. Retail organizations that rely on PLM for supply‑chain and product‑development workflows have also been hit. The breadth of affected sectors indicates that the threat actors are casting a wide net, seeking any organization that exposes Windmill or FlexPLM services to the internet without adequate mitigations.
Indicators of Compromise (IoCs) and Extortion Communications
Ransom‑ISAC has released four IP addresses that match the indicators shared by PTC and are believed to be used by the attackers for command‑and‑control (C2) or payload delivery:
- 216.152.148.54
- 216.152.151.204
- 104.243.35.63
- 5.180.41.35
Extortion emails associated with the campaign appear to originate from previously compromised corporate accounts and are blasted to hundreds of users within an organization. These messages typically contain a demand for payment, instructions for contacting the Cl0p crew (often via Tox or encrypted chat services), and a warning that stolen data will be leaked on the group’s public leak site if the ransom is not met.
External Validation from ReliaQuest
In a separate analysis posted on X (formerly Twitter), ReliaQuest confirmed that threat actors are actively exploiting CVE‑2026‑12569 to achieve unauthenticated RCE and deploy JSP web shells for remote command execution and sensitive product data exfiltration. ReliaQuest’s analysts noted that the observed tradecraft—such as the chaining of vulnerabilities, the use of hex‑named web shells, and the focus on high‑value enterprise data—closely mirrors previous Cl0p operations that have targeted file‑transfer appliances (Accellion FTA, GoAnywhere MFT, SolarWinds Serv‑U FTP, Cleo, MOVEit Transfer) and Oracle E‑Business Suite flaws. This similarity reinforces the attribution to the Cl0p affiliate ecosystem.
Historical Context of Cl0p’s Targeting Patterns
Cl0p has a well‑documented history of exploiting vulnerabilities in widely used enterprise software to gain initial access for data theft and extortion. Past campaigns have leveraged flaws in Accellion’s FTA, GoAnywhere MFT, SolarWinds Serv‑U FTP, Cleo, and MOVEit Transfer, as well as a deserialization bug in Oracle E‑Business Suite. The group’s modus operandi typically involves scanning for internet‑facing services, chaining multiple weaknesses to bypass authentication, installing web shells, and then conducting reconnaissance before exfiltrating valuable data. The current Windmill/FlexPLM attack follows this established pattern, demonstrating the gang’s continued adaptation to new PLM platforms as lucrative targets.
Recommendations for Defenders
Organizations running PTC Windmill or FlexPLM should immediately apply any available patches addressing CVE‑2026‑12569 and the associated FlexPLM WSDL disclosure. If patching is not feasible, they must restrict external access to these services—ideally placing them behind a virtual private network (VPN) or zero‑trust access gateway—and enforce strong network segmentation to limit lateral movement. Continuous monitoring for the listed IoCs, unusual JSP file creation under /Windchill/login/, and anomalous outbound traffic to the defender‑specified IP ranges is essential. Additionally, implementing multi‑factor authentication (MFA) for administrative accounts, conducting regular vulnerability scans, and maintaining an up‑to‑date incident‑response plan will help mitigate the risk of falling victim to this double‑extortion campaign.