Cl0p Exploitation of PTC Windchill and FlexPLM Vulnerability (Campaign)

Attackers target internet-exposed Windchill and FlexPLM deployments by first performing reconnaissance against a WSDL endpoint, exploiting an information-disclosure issue and CVE-2026-12569 (deserialization leading to unauthenticated RCE), and planting hex-named JSP webshells under /Windchill/login/ for persistent access. Post-compromise activity includes filesystem enumeration and file listing (e.g., flst.txt), staging of sensitive engineering and design data for exfiltration, and large-scale extortion emails from compromised accounts threatening public release of stolen data.