"The web shell gives attackers a direct path to credential theft and large-scale data exfiltration, with no additional tooling required," ReliaQuest said.
CVE-2026-12569 and Clop's weaponization
Security researchers say a critical flaw tracked as CVE-2026-12569 (CVSS 9.3) has been weaponized to deploy a JavaServer Pages (JSP) web shell against PTC Windchill and FlexPLM servers. An advisory from Ransom-ISAC together with eCrime.ch and Defused attributed the malicious activity to the Clop (aka Cl0p) ransomware operation and reported that the threat actor dropped JSP web shells on vulnerable systems.
The vulnerability involves improper input validation that could allow an attacker to execute arbitrary code by sending a malicious request to the network — and researchers report that attackers have exploited that pathway to install a purpose-built, application-specific implant inside affected Windchill/FlexPLM instances.
A bespoke Windchill web shell: features and capabilities
ReliaQuest describes the implant as more than a lightweight command shell: it is a fully equipped extortion platform tailored to the Product Lifecycle Management (PLM) software. The tool includes a custom Java class loader that can load attacker-supplied Java bytecode into memory and execute it, delivered as a Base64-encoded ZIP of compiled bytecode. That mechanism provides an in-process route to run secondary payloads without writing new files to disk.
Built-in functions are reported to reflect detailed knowledge of Windchill's APIs, database schema, keystore, and file-vault structure. ReliaQuest researchers John Dilgen and Connor Short wrote that the implant "embeds detailed knowledge of the application's APIs, database schema, keystore, and file-vault structure, enabling rapid movement from access to data theft, without external commands or additional tools."
- Vault enumeration that targets the application database to identify high-value engineering data.
- Execution of queries through Windchill's existing database identity to avoid creating attacker accounts and reduce forensic visibility.
- A custom loader allowing in-memory execution of attacker-supplied Java bytecode for persistence, lateral movement, or encryption tools.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow credentials and vaults are exfiltrated
One of the web shell's notable features is a single "S" command that returns Windchill's directory-management and administrative credentials in plaintext by invoking a built-in function called gs. ReliaQuest lays out the gs function's steps precisely: it
- reads Windchill's "ieStructProperties.txt" configuration file;
- decrypts the LDAP manager password from the application keystore;
- iterates through all stored local properties, decrypting additional encrypted values including administrative account credentials, object storage credentials, and all site administrator keys.
ReliaQuest warns that in active compromise the "S" command can extract the credentials used to manage the organization's LDAP directory, and that "Because LDAP credentials typically govern access to Active Directory, email systems, VPN, and other enterprise services tied to directory authentication, their exposure could turn a single application compromise into an enterprise-wide credential compromise."
Beyond credential decryption, the implant includes a vault-mapping capability that identifies engineering and design assets stored in Windchill without requiring manual discovery commands, and it can exfiltrate the results using built-in commands. ReliaQuest summed up the effect: "Unlike generic command shells, this implant decrypts credentials, delivers malware, and maps stored files for exfiltration."
ReliaQuest attribution and historical precedent
ReliaQuest's analysis links the tool to Clop by behavior and code specialization. The researchers noted that "References to 'Clop' throughout reflect this highly likely attribution." The report places the Windchill implant in a pattern: the same eCrime group previously deployed custom web shells — DEWMODE and LEMURLOOT — after exploiting Accellion (CVE-2021-27101) and MOVEit Transfer (CVE-2023-34362) respective flaws.
ReliaQuest concluded that Clop's model is a targeted evolution of a mass-exploitation playbook: purpose-built implants that operate inside a specific application's trust boundary to steal data quickly and quietly. "The combination of a feature-rich implant that requires no additional tooling to begin stealing data, paired with an extensible delivery mechanism for follow-on capability, gives the adversary a complete toolkit from the moment of access," the firm said.
What this means for PTC Windchill customers, security teams, and procurement leaders
PTC Windchill and FlexPLM customers: The implant targets engineering and product-design vaults and can return administrative and LDAP credentials in plaintext; organizations that use Windchill for proprietary designs will face direct risk of intellectual property and object storage compromise.
Security teams and incident responders: The implant operates within the application's process and leverages existing database identity, reducing forensic visibility and blending with normal Windchill traffic. Teams should watch for signs of in-memory Java class loading, abnormal use of Windchill configuration reads, and unexplained outbound data exfiltration tied to vault queries.
Procurement and risk officers: The campaign illustrates an extortion model that targets software with concentrated sensitive data; the report emphasizes that Clop has revived bespoke web shells when high-value mass-exploitation opportunities appear, and that vendor-supplied applications can be a single point of failure for credentials used across directory-backed services.
ReliaQuest ends with a cautionary image: "This campaign is another reminder that Clop remains a sleeping dragon, always looking and preparing to mass exploit vulnerabilities in software that holds sensitive data." For organizations using Windchill or FlexPLM, the facts in the report frame a stark operational choice: patch and hunt quickly, or risk an implant that can decrypt keystore credentials, map engineering vaults, and turn a single application flaw into enterprise-wide compromise.
