Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

ReliaQuest and other researchers report that the Clop ransomware operation is deploying a bespoke JSP web shell against PTC Windchill and FlexPLM servers via CVE-2026-12569 (CVSS 9.3). The implant is a feature-rich extortion platform that decrypts keystore credentials (including LDAP/administrative secrets), enumerates file vaults, loads attacker Java payloads in memory, and exfiltrates sensitive engineering data, enabling rapid lateral movement, persistence, and large-scale data theft without additional tooling.