Clop's Windchill Implant Decrypts Passwords, Steals Files

Clop has graduated from generic JSP droppers to something purpose-built. ReliaQuest published a breakdown today of a custom Java web shell engineered specifically for PTC Windchill PDMLink and FlexPLM servers — not repurposed from an off-the-shelf tool, but written from scratch to use Windchill’s own internals against it.

What this shell does

The implant imports Windchill-native classes — MethodContext, WTConnection, and WTKeyStoreUtil — and operates through a custom protocol on the X-windchill-req HTTP header, with eight single-character commands:

• S: Reads Windchill’s LDAP configuration and calls the application’s own WTKeyStoreUtil.decryptProperty() to produce the LDAP manager password in plaintext.
• L: Maps the file vault by querying ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem tables directly.
• D / G: Enumerate directories and read complete files.
• R: Deletes files.
• J: Loads and executes Base64-encoded Java bytecode in memory — arbitrary code execution without touching disk.
• O / E: OS identification and data echo for verification.

The credential-decryption function is the one that matters most. With the LDAP manager password in hand, attackers hold a key to the directory service backing the Windchill environment — lateral movement, account pivoting, broader enterprise access from a single beachhead.

CVE-2026-12569 is the door

This shell is being deployed against servers exposed to CVE-2026-12569 (CVSS 9.8, critical) — an unauthenticated deserialization RCE in Windchill PDMLink and FlexPLM that CISA added to the Known Exploited Vulnerabilities catalog on June 25. PTC shipped its first patch June 18, one day after initial disclosure. Systems that haven’t applied it are fully exposed with no authentication barrier between an attacker and this shell.

Attribution

ReliaQuest tied the shell to Clop based on extortion email patterns, the X-windchill-req header matching previously documented Clop TTPs, and confirmation from Ransom-ISAC. This tracks: Clop claimed GE and Philips data theft earlier this month and has been targeting industrial and engineering enterprises throughout this campaign. PTC Windchill is deeply embedded in aerospace, automotive, and defense manufacturing — sectors where stolen engineering files carry obvious espionage value alongside ransom leverage.

What to do

1. Patch CVE-2026-12569 now. If you haven’t, this is the priority. See the CVE entry for affected version ranges and the PTC trust-center advisory for the exact target release for your version line.
2. Hunt for the web shell. Scan your Windchill server for JSP files in unexpected locations, especially under /Windchill/login/. Search web server logs for POST requests containing the X-windchill-req header.
3. Reset LDAP and Windchill credentials. If the system was reachable while unpatched, treat the LDAP manager password and all Windchill service accounts as compromised and rotate them.
4. Reduce perimeter exposure. If the Windchill login endpoint doesn’t need to be internet-facing, move it behind a VPN or firewall rule.

July’s original coverage documented the initial JSP dropper activity. Today’s ReliaQuest analysis is the first detailed breakdown of Clop’s purpose-built tooling for these systems.