Critical Alert: Cl0p Ransomware Targets PTC Windchill and FlexPLM with a Vulnerability Chain

Introduction

On July 25, 2026, the industrial security landscape was shaken by a new aggressive campaign from the Cl0p ransomware group (also known as Chubby Scorpius, FIN11, or Lace Tempest). Attackers are targeting Internet-exposed installations of two PTC products – Windchill (product lifecycle management) and FlexPLM (retail product lifecycle management) – chaining two vulnerabilities to achieve arbitrary code execution without any authentication. The malicious activity has already affected companies in the manufacturing, automotive, aerospace, and retail sectors, leading to theft of design data and double extortion.

Technical Analysis

The attack exploits two distinct flaws in PTC products to build a complete exploit chain.

• Information disclosure on FlexPLM: a vulnerability (CVSS 7.5, currently without a public CVE identifier) in FlexPLM's WSDL endpoint allows an unauthenticated attacker to retrieve sensitive system information. Specifically, the improper exposure of SOAP interface details enables mapping of the internal architecture and collection of useful data for the next stage.
• Remote Code Execution on Windchill (CVE-2026-12569): this is a server-side flaw in Windchill's login servlet, rated CVSS 9.3. By leveraging the information obtained from the first leak, an attacker can invoke the vulnerable servlet without credentials, achieving arbitrary command execution with the application's privileges.

Once access is obtained, Cl0p operators deploy JSP web shells with hexadecimal names in the /Windchill/login/ directory, enumerate the file system, and exfiltrate design, engineering, and intellectual property data. This is followed by typical double extortion: threatening to publish the stolen data while also threatening to disrupt systems if the ransom is not paid. Extortion emails are sent to hundreds of corporate users using previously compromised accounts, increasing psychological pressure.

Indicators of compromise (IoCs) currently associated with this campaign include the following IP addresses:

• 216.152.148.54
• 216.152.151.204
• 104.243.35.63
• 5.180.41.35

Impact

The affected sectors – manufacturing, automotive, aerospace, and retail – handle highly sensitive design data, the theft of which can lead to loss of competitive advantage, intellectual property violations, and reputational damage. Furthermore, the deployment of web shells enables long-term persistence, with the real risk of operational disruption if attackers choose to move to the encryption or sabotage phase. The presence of CVE-2026-12569 in CISA's Known Exploited Vulnerabilities (KEV) catalog underscores the urgency of action for all organizations using the impacted products.

Mitigation

PTC has confirmed the increase in hostile activity and has published a security advisory with the following recommendations:

• Apply patches immediately released for Windchill and FlexPLM. Companies should refer to the official advisory to identify the correct versions and update procedures.
• Reduce attack surface: wherever possible, limit direct Internet exposure of the two services, adopting segmentation, VPN, and conditional access solutions.
• Inspect systems: check the /Windchill/login/ directory for web shells with hexadecimal names. Review logs for abnormal file system enumeration and suspicious requests to FlexPLM's WSDL endpoints.
• Implement IoC monitoring listed, integrating them into detection systems (IDS/IPS, SIEM) to intercept any attempts to communicate with malicious infrastructure.

FAQ

1. Which PTC products are vulnerable and how can I tell if my version is at risk?
The vulnerabilities affect PTC Windchill and PTC FlexPLM. PTC has released security updates and an official advisory detailing the corrected versions. It is recommended to consult the PTC support portal and verify the status of your installation.

2. How can I detect an ongoing or past compromise?
Main signs include: presence of JSP files with hexadecimal names in the /Windchill/login/ folder; network traffic to the reported malicious IP addresses; anomalous requests to FlexPLM WSDL endpoints; unusual file system enumeration in application logs. Targeted forensic analysis can confirm unauthorized access.

3. Besides applying patches, what immediate countermeasures can I take?
Immediately remove direct Internet exposure of Windchill and FlexPLM, placing them behind a VPN or conditional access system. At the same time, initiate active log monitoring, block known IoCs at the firewall level, and prepare an incident response plan that includes isolation of suspicious systems and stakeholder notification.