{"id":2010,"date":"2026-07-25T16:02:00","date_gmt":"2026-07-25T16:02:00","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2010"},"modified":"2026-07-25T16:02:00","modified_gmt":"2026-07-25T16:02:00","slug":"cl0p-affiliates-target-internet-exposed-ptc-windchill-and-flexplm-with-unauthenticated-rce","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2010","title":{"rendered":"Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jul 25, 2026<\/span><\/span>Vulnerability \/\u00a0Ransomware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign.<\/p>\n

\u00abAttackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling unauthenticated remote code execution and deployment of hex-named JSP web shells under \/Windchill\/login\/,\u00bb according to a new coordinated advisory<\/a> released by Ransom-ISAC along with eCrime.ch and DEFUSED.<\/p>\n

Upon gaining an initial foothold, the attackers have been found to conduct file system enumeration, stage engineering\/design data, and ultimately carry out double extortion data theft. Targets of the campaign include manufacturing, automotive, aerospace, and retail sectors.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

It’s suspected that threat actors are exploiting CVE-2026-12569 (CVSS score: 9.3), a critical security flaw in PTC Windmill that was added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog late last month.<\/p>\n

<\/p>\n

In an advisory, PTC warned customers that it had \u00abreceived continued reports of heightened threat activity,\u00bb adding that unknown attackers are exploiting the vulnerability to deploy JSP web shells against susceptible systems.<\/p>\n

\u00abIn the observed intrusions, this RCE is chained with a separate pre-authentication information-disclosure defect in the FlexPLM WSDL endpoint (CVSS v3.1 7.5) to enable unauthenticated exploitation,\u00bb researchers Brandon Parsons, Corsin Camichel, and Simo Kohonen said.<\/p>\n

\"\"<\/a><\/div>\n

Ransom-ISAC has shared four IP addresses as indicators of compromise (IoCs), all of which match those shared by PTC –<\/p>\n