Clop's Windchill Web Shell: From Credential Decryption to Design Data Theft Inside the App

Clop Returns with Custom Implant in Mass-Extortion Campaign

The ReliaQuest Threat Research Team has published a report detailing a critical vulnerability exploited by the Clop ransomware group. This vulnerability, CVE-2026-12569, allows Clop to deploy a custom web shell within the PTC Windchill and FlexPLM applications.

The attack begins with the exploitation of the CVE-2026-12569 vulnerability. This enables the attacker to place a custom Java Server Page (JSP) web shell directly into the Windchill codebase. The web shell then uses the Windchill application's own permissions and internal APIs to carry out its malicious activities.

Once the web shell is in place, the attacker can use a specific HTTP header, X-windchill-req, to send commands to the application. These commands allow the attacker to decrypt credentials in plain text, list design file locations, and ultimately steal sensitive data.

The decrypted credentials can be used for lateral movement within the network. This means attackers can potentially gain access to other systems and move laterally, expanding the scope of the breach. Furthermore, the decrypted LDAP and admin credentials can be used to authenticate to other systems, allowing attackers to maintain persistence within the network.

The web shell also has the capability to query Windchill database tables, listing file IDs, names, paths, and sizes. This information can be used to identify and steal specific files of interest, such as design files and intellectual property. The responses generated by the web shell are compressed using GZIP, making them difficult to detect.

The success of this attack hinges on several conditions. The most critical is that the Windchill or FlexPLM application must be reachable from the outside internet and not yet patched against CVE-2026-12569. The attacker must also be able to place and execute the JSP file, and the Windchill service ID must have sufficient permissions to access the database, vault, and keystore.

If the vendor applies the necessary patch and restricts external access, the attack is unlikely to succeed. However, if these conditions are met, the consequences can be severe. Sensitive data such as LDAP admin credentials, product designs, and intellectual property can be decrypted and exfiltrated. Additionally, the attacker can execute additional Java code directly within the Windchill process memory, bypassing the need to save any files to disk.