Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM product lifecycle management servers to steal engineering and product-design data, according to Ransom-ISAC analysts working alongside eCrime.ch and DEFUSED. The campaign chains a pre-authentication information disclosure in the FlexPLM WSDL endpoint with CVE-2026-12569, a critical deserialization flaw in the Windchill login servlet carrying a CVSS score of 9.8. Intrusions appear to trace back to early June 2026, with the vulnerability disclosed on June 17 and added to the CISA Known Exploited Vulnerabilities catalog on June 25. Victims are now receiving mass extortion emails sent from randomly compromised third-party accounts.
What Happened
Cl0p affiliates, tracked variously as Graceful Spider, Chubby Scorpius, FIN11, and Lace Tempest, identified internet-facing Windchill PDMLink and FlexPLM deployments and attacked them directly, without phishing, without stolen credentials, and without user interaction of any kind.
The operators first queried the FlexPLM WSDL endpoint, which leaks information prior to authentication. That disclosure fed directly into abuse of a weakness in the Windchill login servlet, producing unauthenticated remote code execution on the underlying server. All affected releases predate 11.0 M030.
Once code execution was achieved, the affiliates dropped JSP webshells for persistent server-side access, enumerated the file system, and staged engineering data for bulk exfiltration. The extortion phase followed a familiar Cl0p pattern: rather than contacting a single security or executive point of contact, the group blasted extortion messages to employees across victim organizations, using compromised accounts as the delivery infrastructure.
Ransom-ISAC characterized unpatched, internet-exposed deployments as the primary and continuing entry point for the campaign.
What Was Taken
Windchill is the system of record for the most sensitive material a manufacturer produces. Compromised instances hold CAD models and drawings, bills of materials, product specifications, revision histories, change orders, supplier documentation, and full development workflow records for products that may not have shipped yet.
FlexPLM extends the same exposure into retail and apparel, where it manages seasonal line plans, materials sourcing, tech packs, and costing data.
The reporting confirms that operators staged and removed engineering data prior to issuing demands. Exact per-victim volumes have not been published, but the value of the material is not measured in gigabytes. A single exfiltrated product record set can represent years of research and development investment and can reveal unreleased designs to competitors or to criminal buyers on resale markets.
Cl0p is running a double-extortion model here. Restoring from backup resolves the availability problem and does nothing about the stolen files, which is precisely the leverage the group is counting on.
Why It Matters
Intellectual property theft is not a recoverable incident in the way encryption is. Design data, once copied, cannot be un-copied, and its competitive value persists for the entire commercial life of the product it describes. Manufacturers, automotive suppliers, aerospace organizations, and apparel brands face the sharpest exposure because their Windchill estates concentrate exactly the records that matter most.
There is a second-order risk in the extortion mechanism itself. By mailing every employee from compromised third-party accounts, Cl0p forces a rapid internal investigation while simultaneously seeding a workforce-wide phishing and social engineering opportunity. Staff who receive these messages are primed to click on follow-on lures purporting to offer answers.
The broader lesson tracks with recent Cl0p operations against MOVEit, GoAnywhere, and Cleo: the group has industrialized the practice of finding one exposed enterprise application, weaponizing a pre-auth flaw in it, and harvesting an entire victim class in a matter of weeks. Windchill is simply the current target of that machine, and the window between disclosure on June 17 and KEV listing on June 25 shows how little time defenders get.
For organizations that assumed PLM was too niche or too internal to be targeted, this campaign settles the question.
The Attack Technique
The intrusion chain runs in four stages.
Stage one, reconnaissance and disclosure. The attacker sends an unauthenticated request to the FlexPLM WSDL endpoint, which returns information about the deployment before any credential check occurs.
Stage two, exploitation. That information enables abuse of a deserialization weakness in the Windchill login servlet, tracked as CVE-2026-12569 at CVSS 9.8. The combined chain yields remote code execution with no valid account required. Affected versions are PTC Windchill PDMLink and FlexPLM releases prior to 11.0 M030.
Stage three, persistence. Operators write JSP webshells into the application's web-accessible directories, giving them durable command execution that survives session termination and blends into normal application file structures.
Stage four, collection and exfiltration. The affiliates inspect server files, identify high-value engineering repositories, stage the data, and remove it from the environment before any extortion contact is made.
The notable characteristic of this chain is what it does not require. No mailbox compromise, no malicious attachment, no user error. Exposure alone was sufficient.
What Organizations Should Do
Patch to 11.0 M030 or later immediately. This is the single controlling action. CVE-2026-12569 is on the CISA KEV catalog as of June 25, which carries binding remediation deadlines for federal civilian agencies and should be treated as an equivalent mandate everywhere else.
Remove Windchill and FlexPLM from direct internet exposure. Place these applications behind a VPN or identity-aware proxy. If external partner or supplier access is a genuine business requirement, broker it through an authenticated gateway rather than publishing the application itself.
Hunt for JSP webshells now, not after patching. Patching closes the door but does not evict an attacker who is already inside. Review web-accessible directories for unexpected or recently modified .jsp files, compare against a known-good deployment baseline, and audit application server process trees for anomalous child processes.
Reconstruct the exfiltration timeline back to at least the start of June. Pull outbound network telemetry and application access logs for the full period. Look for large or sustained transfers from PLM hosts to unfamiliar destinations, and for anomalous access patterns against the WSDL and login servlet endpoints.
Warn the entire workforce about the extortion mail and the phishing that follows. Because Cl0p mails employees broadly from compromised accounts, staff need advance notice of what these messages look like and a single reporting channel. Treat any follow-on correspondence referencing the incident as hostile until verified.
Build a standing inventory of internet-exposed enterprise applications. This campaign succeeded against organizations that did not know, or had forgotten, that a PLM server was reachable from the internet. Continuous external attack surface discovery is the control that would have made this a non-event.
Sources: Cl0p Hackers Exploit Windchill Servers to Steal Companies' Secret Product Designs - Cybernoz