Clop Returns with Custom Implant in Mass-Extortion Campaign

ReliaQuest reports active mass exploitation of CVE-2026-12569 in PTC Windchill by the Clop extortion group using a purpose-built Java web shell that immediately decrypts and exfiltrates credentials, enumerates sensitive engineering vaults, and loads additional Java payloads in-memory—enabling rapid data theft, enterprise-wide credential compromise, and follow-on ransomware or lateral movement; the report documents technical behavior, attribution indicators, and urgent mitigation and hunting guidance (patch Windchill, hunt for suspicious JSPs, rotate keystore/LDAP credentials).