Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE49 IOCs

Cl0p Exploitation of PTC Windchill & FlexPLM (CVE-2026-12569)

Ransom-ISAC

Published July 22, 2026Original Report

Threat Actors

Malware Families

Diamond Model

Adversary(2)

Infrastructure

Capability(2)

Victim

Indicators of Compromise

Indicators of Compromise49

Type	Indicator	Confidence	Score	First Seen
MD5	e7dea7cacb124e239e727ddef128bedd file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	a2552b05cd134806a4bda10d56c8cdfe file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	c8a79685ffbe41bdb5692e4ba8771d02 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	47a5d023d0774b5f817643effa562708 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	ee7773a5c3b62ebf0f9df3a7b8a09c02 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	bb3bfdea4edf4d949b5ffb0616222ed2 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	23ac6ac152a34d90b986fec9a15b96df file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	c22e1d0a2ced49ccacb3fae025b2eb00 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	43aec5fd10de4f1dbe7622b94e76d7a6 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	72b0cfb581aa4c26a701a88ccaedff8f file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	8854097a04c04199a97e35cd7d9123a3 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	0cb44545fc4146b5a0274c88078d31f1 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	e16ea289e58942a6b33c34d51dc8b87b file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	95b8d59f0e914c6caa5ddc9bf666e788 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	ce03bd3b07ea4ed48a99133432ae25ab file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	6cb2622eb4fb4642b4280672123fae3e file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	6f0869b8f23942a091e3e6051eaeaa94 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	6e93802ac6f24eaf09a4ff1d3c9cfe0c file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	a2a9c63fa8324e11af773ce9866d7c52 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA1	8be6f433b443545932821058952916d3c066a8e0 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	d1a7ac95794e47a7a7d8764215ed2d5d file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	3f4db01ab0b645c0801c90e9a0efa353 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	ad02c4634b4e4d26950fa8624cd39b73 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	e3e507da427448b09d51b4c860f58919 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	d29f364287ce4f0d9f11e3e889ee032e file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	8ea1cf1b88cb4f76b55670df28807ce2 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	36588fe667a44114936d58aac98f2cdb file-hashintel-blogmalware	Medium	53	Oct 9, 26
CVE	CVE-2026-12569 exfiltrationexploitintel-blog	High	71	Jun 30, 26
MD5	c0e7410e9a074e15980aa29f674624d4 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	9eae6eac94de4092a8835741aca89d56 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA1	05af84bfa569366700d826313cdfde44b5efca48 abusealienvault_ransomwarebad reputation	Medium	42	Aug 6, 26
MD5	f352c90f4d394cc2aa92b01ecc7ac777 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	051e8962b68f426c87ae84b19b8de4af file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	547ce27d08d34630b69676bd92c73447 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	cd68100dfacf4af2a0e198a35c4d8097 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	92cb2682f9be4916a438bc3af4b87054 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	314cc95c21fb4f168cb3b18707b13b68 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	50dc0c2a9fbc4caa67f1f6ad9fc75b9b file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	f31d7a43e41847b9b1cb07fe3fced2d3 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf exploitfile-hashintel-blog	Medium	55	Aug 19, 26
MD5	f529d0db850d44b8807dfd365cd46105 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	a85e1d0394ae43a8803916c71c7273a1 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c exploitfile-hashindicator	Medium	51	Jun 23, 26
MD5	a82bd8887f76416e9ee860e2bd615910 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	da0b8f9bf1b14ae59fcf251bb7bb2ee3 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	8e362ecf0aa34cb396fe78f43d25c2e9 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	c8d2be891f85455d8e139e0428434203 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	eb21de20c0434109b930047f0e08448a file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	3432991218cf4dbc93bff5133e220954 file-hashintel-blogmalware	Medium	53	Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph49 total IOCs

MD5SHA1CVESHA256

scroll to zoom · drag to pan · click IOC to open