Clop attackers stole Windchill blueprints without a password
The Clop extortion gang broke into PTC Windchill and FlexPLM systems without needing a password, then stole engineering files and posted nearly 50 company names, including Shell, Philips, Fiserv, and GE, to its leak site. The attackers used a flaw in the software itself to get in, not stolen logins.
- Report priority
- Medium
- Involves
- PTC Windchill
What is known
Attackers exploited an unauthenticated flaw in Windchill and FlexPLM, tracked as CVE-2026-12569, to get into the application without any login, then planted a custom program disguised as normal Windchill code so it could read files and steal stored credentials.
What to do
Check whether your organization runs PTC Windchill or FlexPLM and compare its version against PTC's advisory for CVE-2026-12569, which was added to CISA's Known Exploited Vulnerabilities catalog on June 25. Researchers believe exploitation may have started even earlier that month, so treat any internet-facing instance as a hunt target back to early June.
Apply PTC's remediation guidance for CVE-2026-12569 from its trust center advisory, then search Windchill's application directories for unexpected new files and rotate every credential stored in the Windchill keystore and terminate active sessions, since a password change alone can leave stolen tokens still usable.
Reported details
Clop finds an internet-facing Windchill or FlexPLM server running the vulnerable code and exploits CVE-2026-12569 to get in without a password. The group plants a custom implant that behaves like part of Windchill itself, using the application's own functions to pull data from its file vault and decrypt stored passwords. Researchers at ReliaQuest say the implant took commands through a hidden web request header and could load more code straight into memory, letting the attackers pull out product design files and other credentials before Clop emailed the victims to demand payment.
The implant analyzed by ReliaQuest called Windchill's own internal Java classes and understood its vault database structure, letting it use the application's built-in functions to decrypt stored directory, administrator, and storage credentials rather than brute-forcing or phishing for them. It arrived as text, was compiled by the servlet engine, and ran inside Windchill's existing long-running Java process and database connection, so it blended into normal application behavior instead of showing up as a separate binary or new account. It took commands through a custom HTTP header, X-windchill-req, which Apache's default combined log format does not record, complicating detection.