Full Report
The observed attack chain begins with reconnaissance against the FlexPLM WSDL endpoint, followed by exploitation of the information disclosure vulnerability and CVE-2026-12569, a deserialization flaw that enables unauthenticated remote code execution. Attackers deploy hex-name...
Analysis Summary
# Incident Report: Cl0p Exploitation of PTC Windchill and FlexPLM Vulnerability
## Executive Summary
In July 2026, the Cl0p ransomware gang launched a targeted campaign exploiting vulnerabilities in PTC Windchill and FlexPLM software. By chaining information disclosure with a critical deserialization flaw, attackers gained unauthenticated remote code execution (RCE) to deploy webshells and exfiltrate sensitive engineering data. The incident resulted in large-scale extortion attempts against organizations maintaining internet-exposed deployments of these PLM (Product Lifecycle Management) platforms.
## Incident Details
- **Discovery Date:** July 2026
- **Incident Date:** July 2026
- **Affected Organization:** Multiple; organizations utilizing PTC Windchill/FlexPLM
- **Sector:** Manufacturing, Engineering, and Industrial Design
- **Geography:** Global (Internet-exposed deployments)
## Timeline of Events
### Initial Access
- **Date/Time:** July 22, 2026 (Public reporting date)
- **Vector:** 1-day vulnerability exploitation
- **Details:** Attackers performed reconnaissance against the FlexPLM WSDL endpoint. They exploited an information disclosure vulnerability followed by CVE-2026-12569 (a deserialization flaw) to achieve unauthenticated RCE.
### Lateral Movement
- **Details:** Following the initial breach, attackers conducted filesystem enumeration. They systematically scanned directories to identify sensitive engineering and design data, often generating file listings saved as `flst.txt`.
### Data Exfiltration/Impact
- **Details:** Sensitive intellectual property, specifically engineering designs and product lifecycle data, was staged and exfiltrated. Following theft, the attackers sent large-scale extortion emails from compromised accounts to pressure victims into paying a ransom.
### Detection & Response
- **Discovery:** Detection via unusual reconnaissance against WSDL endpoints and the presence of unauthorized JSP files.
- **Response:** Security researchers identified the Cl0p-associated methodology and documented the use of hex-named webshells.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2026-12569 (Deserialization) and information disclosure vulnerabilities.
- **Persistence:** Deployment of hex-named JSP webshells within the `[target-domain] hxxp[://]Windchill/login/` directory.
- **Defense Evasion:** Use of 1-day vulnerabilities and deployment of webshells in standard application directories to blend with web traffic.
- **Discovery:** Resource enumeration against WSDL endpoints and filesystem scanning (generating `flst.txt`).
- **Collection:** Staging of engineering and design files.
- **Exfiltration:** Data exfiltrated for double-extortion purposes.
- **Impact:** Ransomware-style extortion (RansomOp) without necessarily encrypting files, relying on the threat of public data release.
## Impact Assessment
- **Financial:** Potential ransom demands and costs associated with incident response and forensic audits.
- **Data Breach:** High-value intellectual property, including proprietary engineering and design data.
- **Operational:** Disruption to product lifecycle management and engineering workflows.
- **Reputational:** Risk of public disclosure of stolen sensitive data on Cl0p's leak site.
## Indicators of Compromise
- **Network Indicators:**
- Reconnaissance traffic directed at `/WSDL` endpoints.
- Large data transfers to unauthorized external endpoints.
- **File Indicators:**
- `flst.txt` (File listings generated by attackers).
- Hex-named `.jsp` files located in `/Windchill/login/` (e.g., `a1b2c3d4.jsp`).
- **Behavioral Indicators:**
- Unexpected outbound emails from internal accounts (extortion attempts).
- Unauthenticated RCE attempts originating from the PTC Windchill application service.
## Response Actions
- **Containment:** Disconnection of internet-exposed PTC Windchill and FlexPLM instances until patched.
- **Eradication:** Removal of unauthorized JSP webshells and deletion of attacker-generated `flst.txt` files.
- **Recovery:** Restoration of system integrity and rotation of all credentials associated with the affected servers.
## Lessons Learned
- **Vulnerability Patching:** The speed at which Cl0p weaponized 1-day vulnerabilities highlights the need for immediate patching of internet-facing PLM software.
- **Endpoint Exposure:** Critical infrastructure endpoints (like WSDL) should be restricted via IP commercial/VPN access or Web Application Firewalls (WAF) to prevent unauthorized reconnaissance.
## Recommendations
- **Patch Management:** Immediately apply security updates for CVE-2026-12569 and related PTC Windchill/FlexPLM vulnerabilities.
- **Network Segmentation:** Place PLM systems behind a VPN or Zero Trust Network Access (ZTNA) solution to remove them from the public internet.
- **Monitoring:** Implement file integrity monitoring (FIM) on web server directories (like `/login/`) to detect the unauthorized creation of JSP files.