Full Report
A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. [...]
Analysis Summary
# Threat Actor: Clop (TA505 / Lace Tempest)
## Attribution & Identity
* **Actor Name:** Clop (also known as Cl0p)
* **Aliases:** Linked to TA505 and Lace Tempest.
* **Known Associations:** Often associated with large-scale ransomware-as-a-service (RaaS) operations and mass-exploitation data theft campaigns.
* **Attribution Confidence:** High. Attribution is based on extortion emails containing Clop-specific data leak site addresses, unique HTTP headers (`X-windchill-req`) previously observed in their operations, and TTPs consistent with their historical mass-exploitation playbook.
## Activity Summary
The article details a 2026 campaign targeting **PTC Windchill** and **FlexPLM** servers. The threat actor exploited **CVE-2026-12569**, a critical remote code execution (RCE) vulnerability, to deploy a highly specialized JavaServer Pages (JSP) web shell. Unlike generic implants, this web shell was custom-built with deep integration into Windchill’s internal APIs to facilitate credential decryption and large-scale data exfiltration.
## Tactics, Techniques & Procedures
* **Exploitation of Public-Facing Applications:** Exploiting CVE-2026-12569 for initial access.
* **Application-Specific Malware:** Use of a custom JSP web shell that imports Windchill-specific Java classes (`MethodContext`, `WTConnection`, `WTKeyStoreUtil`).
* **Credential Decryption:** Using native application functions (e.g., `decryptProperty()`) to extract LDAP manager passwords and other encrypted data.
* **Database Interaction:** Querying internal application tables (`ApplicationData`, `FVITEM`, `FVMOUNT`) using the application’s own service identity to bypass anomaly detection.
* **Custom C2 Protocol:** Command and control via a custom HTTP header (`X-windchill-req`) containing a specific 8-character token.
* **In-Memory Execution:** Capability to load and execute Base64-encoded Java bytecode directly into memory from ZIP archives (Command `J`).
* **Data Exfiltration:** Automated mapping of file vaults and retrieval of contents.
## Targeting
* **Sectors:** Manufacturing, Engineering, Retail (specifically users of Product Lifecycle Management/PLM software).
* **Geography:** Global (targeting any organization with exposed PTC Windchill/FlexPLM instances).
* **Victims:** Over 2,770 organizations were affected in previous campaigns (MOVEit); hundreds of employees were targeted with extortion emails in the current Windchill campaign.
## Tools & Infrastructure
* **Malware:** Custom Java JSP Web Shell (Windchill-specific).
* **Infrastructure:**
* **C2 Headers:** `X-windchill-req` (Command/Auth), `X-windchill-prm` (Data).
* **Data Leak Sites:** Clop ransomware leak site (URL not specified but referenced in extortion emails).
* **Vulnerabilities:** CVE-2026-12569.
## Implications
This campaign represents a strategic shift toward **application-aware malware**. By building implants that interface directly with a target application's internal API and database schema, Clop can:
1. **Evade Detection:** Queries appear as legitimate internal application traffic.
2. **Increase Efficiency:** Automates the location of the "crown jewels" (vaulted files) without manual lateral movement.
3. **Bypass Encryption:** Uses the application's own keystore to decrypt credentials on the fly.
## Mitigations
* **Patching:** Immediately apply fixes for **CVE-2026-12569** provided by PTC.
* **Detection:** Scan Windchill directories for suspicious `.jsp` files, specifically those referencing the string `X-windchill-req`.
* **Identity Management:** Rotate the LDAP manager password and any other credentials stored within Windchill if a compromise is suspected.
* **Network Security:** Restrict access to Windchill and FlexPLM management interfaces to internal networks or via VPN only.
* **Log Analysis:** Review database telemetry for unusual queries against the `ApplicationData` or `FVITEM` tables, even if originating from a service account.