Do Son 
Clop's CVE-2026-12569 extortion email | Image: Ransom-ISAC
At a glance
| Malware family | Custom Java web shell (unnamed implant) |
| Threat actor | Clop / Cl0p (highly likely attribution) |
| Targets | Manufacturers running PTC Windchill; Shell named among affected firms |
| Delivery vector | Exploitation of CVE-2026-12569 (CVSS 9.3) in PTC Windchill |
| Key capabilities | Credential decryption, vault mapping, in-memory code loading, data theft |
| Source | ReliaQuest Threat Research; BleepingComputer |
TL;DR
ReliaQuest found a custom Clop web shell built for PTC Windchill. It decrypts stored credentials and maps engineering files for theft. The tool marks Clop’s return to mass exploitation.
What happened
ReliaQuest tied a new Java web shell to the Clop extortion group. Attackers plant it after exploiting CVE-2026-12569, a critical flaw in PTC Windchill. That platform stores product designs for manufacturers worldwide.
The flaw carries a CVSS score of 9.3. It allows remote code execution without a login. PTC began shipping patches on June 17, 2026, and CISA later added the bug to its Known Exploited Vulnerabilities catalog.
This is not a generic tool. As ReliaQuest puts it, the implant is “a fully equipped extortion platform”. It steals data from the moment it lands, with no extra tooling required.
Delivery and infection chain
The attack starts with an exposed Windchill server. Clop exploits the deserialization flaw to run code. Then it drops a JavaServer Pages web shell into the application’s own directories.
The web shell knows Windchill inside out. It embeds the app’s APIs, database schema, keystore, and file-vault layout. Because of that, the group moves from access to theft in minutes.
One command exposes credentials
A single command tells the Clop web shell to dump credentials in plaintext. It reads a config file, then decrypts the LDAP manager password from the keystore. Next, it unlocks admin accounts, storage keys, and site administrator keys.
LDAP credentials often govern Active Directory, email, and VPN access. Therefore, one server breach can spread across the whole enterprise. ReliaQuest warns this can turn a single hit into an “enterprise-wide credential compromise”.
Command-and-control and data theft
The implant hides its traffic well. It routes commands through a custom HTTP header rather than the request body. It also compresses responses with GZIP, so returned data looks like normal web content.
The web shell queries Windchill’s database through the app’s own internal classes. As a result, the activity runs under the application’s trusted identity. Standard alerts that flag new accounts or odd hosts often miss it.
A built-in function maps the file vault before anything leaves the server. It records stream IDs, filenames, paths, and sizes into a list file. This gives operators a ready menu of intellectual property to steal.
A reusable in-memory backdoor
The most dangerous piece is a custom Java class loader. It accepts a packed archive of compiled code and runs it in memory. Nothing gets written to disk, which cuts the traces defenders can find.
This turns the web shell into a launch pad. Operators can push new malware, spreading tools, or file-encrypting payloads. So the threat extends well past simple data theft into possible ransomware.
Who is behind it
Attribution is highly likely, not confirmed. ReliaQuest points to three signals. Extortion emails match addresses on Clop’s leak site, the custom header appears in past Clop reporting, and the tactics fit the group’s playbook.
Clop has a long record of this pattern. It deployed similar custom web shells after the MOVEit and Accellion campaigns. Reporting names energy giant Shell among the firms tied to the current wave.
How to stay protected
Patching alone is not enough here. A web shell planted before the fix will survive the update. Apply the vendor fix for CVE-2026-12569 right away. Then hunt for suspicious JSP files in Windchill directories. Finally, rotate every credential in the Windchill keystore on any server you suspect.
Detection needs header logging, response decompression, and TLS inspection together. Without all three, coverage stays partial. Treat any exposed Windchill instance as a priority for review.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
