Clop-linked Windchill web shell decrypts credentials and maps vault data
ReliaQuest has analysed a JavaServer Pages web shell linked to the Clop ransomware operation that was deployed after exploitation of CVE-2026-12569 in PTC Windchill and FlexPLM. The vulnerability has a CVSS score of 9.3 and is an improper-input-validation flaw that can permit arbitrary code execution through a malicious network request.
The implant is tailored to the enterprise product lifecycle management applications rather than operating as a generic command shell. ReliaQuest said it can map sensitive vault data, decrypt every credential in the Windchill keystore and execute further code through a custom Java class loader. Those capabilities give an intruder a route to remote access and post-compromise activity, including lateral movement, persistence, ransomware deployment and data theft.
Application-specific access to credentials and designs
The shell’s single S command invokes a built-in function named gs. It reads Windchill’s ieStructProperties.txt configuration file, decrypts the LDAP manager password from the application keystore, and iterates through local properties to recover other encrypted values. ReliaQuest identified administrative-account credentials, object-storage credentials and site administrator keys among the data it can expose.
In an active compromise, the same command can retrieve credentials used to manage the organisation’s LDAP directory. As LDAP credentials can govern access to Active Directory, email, VPN and other directory-authenticated services, their exposure can extend an application compromise into a broader credential incident.
The campaign follows the exploitation chain described in Windchill and FlexPLM code-execution risk, where vulnerable Windchill and FlexPLM instances face unauthenticated code-execution risk and attackers can establish a foothold inside systems that store product designs and engineering data.
Discovery and payload delivery within the application process
ReliaQuest said the web shell includes vault-enumeration functionality that queries the application database to identify high-value engineering data without manual discovery commands. It uses Windchill’s existing database identity rather than creating a separate attacker-controlled account, reducing forensic visibility.
The shell can also accept a Base64-encoded ZIP archive containing compiled Java bytecode. Its custom loader brings that code directly into memory for execution, allowing secondary payloads to be delivered on demand for persistence, network traversal or data encryption.
By using the application’s APIs, database schema, keystore, file-vault structure and established database connections, the implant can conduct discovery and credential access within Windchill’s trust boundary. ReliaQuest said this activity can resemble standard application functions and regular Windchill traffic, limiting the effectiveness of traditional signature-based detection.
What security teams should prioritise
Ransom-ISAC, eCrime.ch and Defused attributed the malicious activity to the Clop, or Cl0p, operation. The group has previously used custom shells after exploiting Accellion and MOVEit Transfer flaws, including DEWMODE and LEMURLOOT.
Organisations running Windchill or FlexPLM should treat suspected exploitation as more than a web-server incident. A practical response is to patch CVE-2026-12569, investigate for JSP web shells and unusual application activity, rotate potentially exposed Windchill and directory credentials, and assess access to engineering vaults and connected enterprise services.