Clop Data Theft Campaign Hits PTC Windchill, FlexPLM

The Clop ransomware gang is running active data theft extortion against internet-exposed PTC Windchill and FlexPLM instances, exploiting CVE-2026-12569 — the unauthenticated RCE that landed on the CISA KEV catalog in June. BleepingComputer reported the attribution on July 24, 2026, with ReliaQuest confirming active exploitation as of today.

The playbook is what you’d expect from a Clop data theft operation: get in through the RCE, drop JSP webshells, exfiltrate PLM data, then send extortion demands and post whatever they took to a dark web leak site if the ransom isn’t paid. Extortion emails in this campaign are coming from support@cryptohox.com.

This hits aerospace, defense, automotive, and manufacturing — the sectors where PLM platforms hold engineering IP, BOMs, CAD files, and supplier data. That’s the material Clop is after: high-leverage, hard to walk back once it’s out.

The honest timeline:

• 2026-06-17 — PTC releases patches; exploitation in the wild confirmed the same day
• 2026-06-25 — CISA adds CVE-2026-12569 to KEV with a three-day federal mandate
• 2026-06-28 — Federal agency patch deadline under BOD 26-04
• 2026-07-24 — ReliaQuest confirms Clop is running an active, defined extortion campaign against unpatched instances

We covered the original vulnerability and the JSP webshells landing on unpatched instances in July. Six weeks later, Clop is making explicit what was implied: this is a named actor running a structured campaign, not opportunistic scanning noise.

What to actually do

If your Windchill or FlexPLM instance is still internet-facing and unpatched, take it offline or put it behind a VPN or trusted access gateway right now. That is the single action that matters today.

After that, in rough priority order:

1. Patch. PTC’s fixed releases are documented in advisory CS473270 (customer login required) and the public trust-center posting. Get to the designated fixed release for your version line — check the advisory for the exact target by build.

2. Check for indicators of compromise. Review logs for POST requests to /Windchill/login/*.jsp, scan the filesystem for JSP files matching a random hex name under the login path, and push a WAF rule blocking requests carrying the X-windchill-req: header. PTC and CISA have the full IOC set in the vendor advisory.

3. If you think you’re already hit: isolate the server before doing anything else, collect forensic evidence, and rotate every credential accessible from that host. Assume the PLM data is out until forensics says otherwise. That last part is the hard one.

4. Treat it as compromised if it was exposed after June 17. An internet-reachable, unpatched Windchill instance since the patch drop is a presumed compromise, not a maybe.

The CISA federal deadline for this CVE was June 28. That was nearly four weeks ago. Clop isn’t the first group to hit unpatched Windchill instances — they’re the first with a defined extortion operation against them. The gap between “KEV addition” and “named ransomware gang working the list” was about a month. That’s the window that’s already closed.

Clop ran the same model against MoveIT Transfer — mass-exploit an enterprise platform, pull data, extort at scale. They’re good at it, and they are patient about collecting from stragglers. The only reliable move at this point is not being on the list.