Clop Ransomware Deploys Bespoke Web Shell to Exploit PTC Windchill Servers

ReliaQuest discovers Clop-linked bespoke web shell exploiting PTC Windchill servers. ReliaQuest uncovered a custom JavaServer Pages web shell targeting a critical flaw in PTC Windchill and FlexPLM. The CVSS 9.3 vulnerability (CVE-2026-12569) allows attackers to execute arbitrary code via malicious network requests. A built-in "S" command decrypts Windchill's administrative and directory-management credentials in plaintext. The payload relies on a Base64-encoded ZIP file containing compiled Java bytecode to run attacker-supplied code directly in memory. "It embeds detailed knowledge of the application's APIs, database schema, keystore, and file-vault structure, enabling rapid movement from access to data theft, without external commands or additional tools." — John Dilgen and Connor Short Ransomware operators are ditching generic scripts to deploy bespoke application malware that operates entirely within trusted network boundaries.