PTC Windchill & FlexPLM Zero-Day Data Theft Campaign

ClopWindchillFlexPLMData Theft

A data theft extortion campaign is exploiting CVE-2026-12569, a critical unauthenticated remote code execution vulnerability caused by insecure deserialization (CWE-502) in PTC Windchill PDMLink and FlexPLM product lifecycle management platforms, to deploy persistent JSP webshells and exfiltrate sensitive engineering and product data. ReliaQuest reports the observed tradecraft shares characteristics with previous Clop (Cl0p) campaigns against enterprise file-transfer and data-repository platforms, though the actor behind these specific attacks remains unconfirmed, and victim organizations have begun receiving extortion emails from a new Clop-associated address, [email protected].

Indicators of Compromise

Hashes (1)

55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c

IPv4 (12)

172.111.38.31104.243.35.131209.222.98.44216.152.151.20478.128.113.10104.194.9.1438.60.157.212216.152.148.54104.243.35.63185.227.83.2365.180.41.3574.50.76.146

CVEs (1)

CVE-2026-12569

Emails (1)

[email protected]

Notes

Notes/Conclusion<ul style="margin-top:0;margin-bottom:0;"><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;">Attribution to Clop/Cl0p is unverified. ReliaQuest explicitly states the actor behind these attacks remains unconfirmed, and that the observed tradecraft only shares characteristics with previous Clop campaigns against enterprise applications and high-value data repositories; the [email protected] extortion contact is BleepingComputer's basis for the Clop association, not a vendor-confirmed attribution.</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;">This matches Clop's established modus operandi across Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, MOVEit Transfer, and the ongoing Oracle E-Business Suite campaign: mass exploitation of an enterprise platform zero-day, bulk data exfiltration, and extortion via a dark web leak site rather than on-host encryption.</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;">CVSS scoring is inconsistent across sources: NVD lists the PTC-submitted CVSS 4.0 base score as 9.3 (CVSS-B, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/U:Red); several secondary sources report 9.8 or 9.1. NVD itself has not yet published an independent enrichment score, and only the vendor-submitted (PTC) score is currently authoritative.</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;">This is the first confirmed in-the-wild exploitation and first CISA KEV listing for a PTC product vulnerability, per SecurityWeek.</li></ul>Related SOCRadar platform modules: <a href="https://socradar.io/extended-threat-intelligence/attack-surface-management/">Attack Surface Management</a> | <a href="https://socradar.io/extended-threat-intelligence/cyber-threat-intelligence/">Cyber Threat Intelligence</a> | <a href="https://socradar.io/extended-threat-intelligence/">Extended Threat Intelligence</a><div> </div>

Mitigation

Mitigation<ul style="margin-top:0;margin-bottom:0;"><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1051/">M1051</a>  – Update Software</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1050/">M1050</a>  – Exploit Protection</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1048/">M1048</a>  – Application Isolation and Sandboxing</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1016/">M1016</a>  – Vulnerability Scanning</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1030/">M1030</a>  – Network Segmentation</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1035/">M1035</a>  – Limit Access to Resource Over Network</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1026/">M1026</a>  – Privileged Account Management</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1037/">M1037</a>  – Filter Network Traffic</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1042/">M1042</a>  – Disable or Remove Feature or Program</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1018/">M1018</a>  – User Account Management</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1031/">M1031</a>  – Network Intrusion Prevention</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1057/">M1057</a>  – Data Loss Prevention</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1047/">M1047</a>  – Audit</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1017/">M1017</a>  – User Training</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1045/">M1045</a>  – Code Signing</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1040/">M1040</a>  – Behavior Prevention on Endpoint</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1022/">M1022</a>  – Restrict File and Directory Permissions</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1049/">M1049</a>  – Antivirus/Antimalware</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1038/">M1038</a>  – Execution Prevention</li></ul>