A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files.
Cybersecurity company ReliaQuest analyzed the web shell after it is believed to have been deployed in recent data theft attacks exploiting CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill.
ReliaQuest says the implant is not a generic web shell repurposed for the attacks, but was instead built with detailed knowledge of Windchill’s internal APIs, database schema, keystore, and file-vault structure.
“This appears to be an application-specific evolution of Clop’s established mass-exploitation playbook,” ReliaQuest said in a report shared with BleepingComputer.
The researchers say they found the web shell during the intelligence collection process.
The researchers say the activity is likely linked to Clop based on extortion emails containing addresses used on the ransomware gang’s data leak site, previously observed X-windchill-req headers also used in the web shell, and TTps commonly used by the threat actors.
The Clop extortion gang has a long history of breaching enterprise platforms in data theft attacks, with previous campaigns targeting Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer file-sharing servers, the latter affecting more than 2,770 organizations worldwide.
As BleepingComputer reported in July, Clop targeted exposed PTC Windchill and FlexPLM servers in a data theft extortion campaign involving exploitation of CVE-2026-12569 and the deployment of JSP web shells.
At the time, ReliaQuest said attribution was unconfirmed, but the attacks shared similarities with previous Clop data-theft campaigns targeting secure file-sharing applications.
Ransom-ISAC later confirmed Clop activity associated with the attacks, including extortion emails sent to hundreds of employees at affected organizations and containing the gang’s latest contact information.
PTC began releasing fixes for CVE-2026-12569 on June 17, and CISA later added the vulnerability to its Known Exploited Vulnerabilities catalog following warnings of heightened threat activity.
Analysis by ReliaQuest and BleepingComputer confirms the tool was designed to target Windchill servers rather than act as a generic web shell.
The malware is a JavaServer Pages (JSP) web shell that directly imports Windchill-specific classes, including MethodContext, WTConnection, and WTKeyStoreUtil.
These classes allow the shell to use Windchill’s own functions to access its database, decrypt stored credentials, and locate files stored in application vaults.
“The web shell connects to Windchill’s database through the application’s own MethodContext and WTConnection classes, meaning its queries run under the application’s existing database identity rather than through a separately configured attacker account,” explains ReliaQuest.
“As a result, database telemetry may attribute this activity to the application’s normal service identity, limiting the value of alerts that rely solely on detecting new accounts or unexpected source hosts.”
The web shell is controlled using a custom protocol sent through the HTTP X-windchill-req header, which contains eight characters, with the first character specifying the command and the remaining seven matching a fixed value.
The web shell supports the following commands:
ReliaQuest says the web shell’s vault enumeration is also designed specifically to query certain tables in Windchill’s database. BleepingComputer’s analysis shows that these tables are ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem.
The cybersecurity company recommends that organizations immediately patch vulnerable Windchill systems and look for unusual JSP files in Windchill directories, especially those containing reference to X-windchill-req.
Organizations that suspect their Windchill servers were compromised should also change the LDAP manager password and other Windchill credentials, as they should be considered compromised.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Clop ransomware targets Windchill, FlexPLM in data theft attacks
Philips and GE investigating Clop ransomware data theft claims
Shell investigates ‘potential incident’ after Clop data theft claims
Data analyst sent to prison for stealing data, extorting employer
Wesco confirms security incident after ExfilSquad claims data theft
Microsoft confirms GitHub is down worldwide
Hacker claims 3.6 million Azure account records stolen from major companies
Anthropic confirms Claude is down in major outage affecting multiple services
91% of AI Apps Appeared in 16 Months. Get Material’s OAuth Risk Report
Stop AI slopsquatting attacks. Secure open source package ingestion before it hits your build.
Signature-based prevention fell to 50%. See what your controls still stop.
Overdue a password health-check? Audit your Active Directory for free
Certighost CVE is new. The privilege behind it isn’t. Discover where yours is hiding.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
