Security researchers at ReliaQuest have uncovered a custom Java web shell tied to the Clop ransomware gang that was built specifically to attack PTC Windchill and FlexPLM servers. The shell was likely deployed in recent data theft campaigns exploiting CVE-2026-12569, a critical remote code execution vulnerability in PTC Windchill. Unlike generic web shells, this implant was crafted with deep knowledge of Windchill's internal APIs, database schema, keystore, and file-vault structure, according to ReliaQuest's report. The company described it as an application-specific evolution of Clop's mass-exploitation playbook.
The web shell is a JavaServer Pages implant that directly imports Windchill-specific classes, including MethodContext, WTConnection, and WTKeyStoreUtil. These classes allow the shell to use Windchill's own functions to access its database, decrypt stored credentials, and locate files in application vaults. ReliaQuest noted that because the shell connects through the application's existing database identity, telemetry may attribute the activity to normal service operations, limiting the value of alerts based on new accounts or source hosts. The tool is controlled via a custom protocol in the HTTP X-windchill-req header, with an eight-character value where the first character specifies the command.
ReliaQuest's analysis, shared with BleepingComputer, found that the shell's vault enumeration queries specific tables in Windchill's database, including ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem. The attribution to Clop is based on extortion emails containing addresses from the gang's data leak site, previously observed X-windchill-req headers, and tactics consistent with the threat actors. The researchers discovered the web shell during their intelligence collection process.
Clop has a long history of targeting enterprise platforms in data theft attacks, with prior campaigns hitting Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer file-sharing servers. The MOVEit campaign affected more than 2,770 organizations worldwide. As previously reported by BleepingComputer in July, Clop targeted exposed PTC Windchill and FlexPLM servers in an extortion campaign exploiting CVE-2026-12569 and deploying JSP web shells. At that time, attribution was unconfirmed, but the attacks shared similarities with earlier Clop campaigns.
Ransom-ISAC later confirmed Clop's involvement, noting extortion emails sent to hundreds of employees at affected organizations and containing the gang's latest contact information. PTC began releasing fixes for CVE-2026-12569 on June 17, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog following warnings of heightened threat activity. ReliaQuest recommends that organizations patch vulnerable Windchill systems immediately and look for unusual JSP files in Windchill directories, especially those referencing X-windchill-req. Organizations suspecting compromise should also change the LDAP manager password and other Windchill credentials, as they should be considered compromised.
