--- title: Clop created custom web shell for Windchill data theft... description: A custom Java web shell tied to the Clop ransomware/extortion gang has been built specifically for PTC Windchill and FlexPLM servers, exploiting... canonical: https://daily.dev/posts/clop-created-custom-web-shell-for-windchill-data-theft-attacks-0ioqafvyo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Clop created custom web shell for Windchill data theft attacks | daily.dev og:description: A custom Java web shell tied to the Clop ransomware/extortion gang has been built specifically for PTC Windchill and FlexPLM servers, exploiting... og:url: https://daily.dev/posts/clop-created-custom-web-shell-for-windchill-data-theft-attacks-0ioqafvyo og:image: https://api.daily.dev/og/posts/0iOQafvyo.png og:image:alt: Clop created custom web shell for Windchill data theft attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Clop created custom web shell for Windchill data theft attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 0 upvotes · 0 comments ## Summary A custom Java web shell tied to the Clop ransomware/extortion gang has been built specifically for PTC Windchill and FlexPLM servers, exploiting CVE-2026-12569. Unlike generic web shells, it leverages Windchill's own internal classes (MethodContext, WTConnection, WTKeyStoreUtil) to decrypt LDAP credentials, enumerate database tables for file vaults, retrieve or delete files, and even load and execute arbitrary Java bytecode in memory. Commands are issued through a custom X-windchill-req HTTP header. Because the shell reuses Windchill's own database identity, its activity can blend in with normal application traffic, limiting detection. PTC began patching the flaw in June, and CISA added it to its Known Exploited Vulnerabilities catalog. Organizations are urged to patch immediately, hunt for suspicious JSP files referencing X-windchill-req, and rotate LDAP and other Windchill credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-12569 and how is it being exploited against PTC Windchill? CVE-2026-12569 is a critical remote code execution vulnerability in PTC Windchill that the Clop extortion gang has exploited to deploy a custom JSP web shell for data theft. The web shell uses Windchill's own internal classes, including MethodContext, WTConnection, and WTKeyStoreUtil, to decrypt LDAP credentials and steal files from application vaults. PTC began releasing fixes on June 17, and CISA later added the flaw to its Known Exploited Vulnerabilities catalog. _Track emerging CVEs like this one on daily.dev before they hit your production Windchill environment._ ### What commands does the Clop Windchill web shell support? It supports eight single-character commands sent via the HTTP X-windchill-req header: S to steal LDAP and configuration secrets using Windchill's own decryptProperty function, L to map the file vault into flst.txt, D to enumerate directories, G to read a file, R to delete a file, J to load and execute Base64-encoded Java bytecode in memory, O to identify the OS, and E to echo data for verification. _Security teams hardening Windchill deployments can follow incident details like these on daily.dev._ ### How can I detect if my PTC Windchill server was compromised by this web shell? Look for unusual JSP files in Windchill directories, especially any referencing the X-windchill-req header, since the web shell is controlled through this custom HTTP header rather than standard commands. Because the shell queries the database using Windchill's own MethodContext and WTConnection classes under the application's existing identity, normal account-based or new-host detection alerts may not catch it. Rotate the LDAP manager password and other Windchill credentials if compromise is suspected. _daily.dev helps defenders keep up with fast-moving exploitation campaigns like this Windchill attack._ ## Similar posts on daily.dev - [Clop ransomware targets Windchill, FlexPLM in data theft attacks](https://daily.dev/posts/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks-xzhdkyy8m) · BleepingComputer · 1 upvotes · 0 comments - [Hackers exploit critical PTC Windchill PLM software flaw](https://daily.dev/posts/hackers-exploit-critical-ptc-windchill-plm-software-flaw-rcw1fezbb) · CSO Online · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/clop-created-custom-web-shell-for-windchill-data-theft-attacks-0ioqafvyo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Clop created custom web shell for Windchill data theft attacks","url":"https://daily.dev/posts/clop-created-custom-web-shell-for-windchill-data-theft-attacks-0ioqafvyo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/clop-created-custom-web-shell-for-windchill-data-theft-attacks-0ioqafvyo"},"datePublished":"2026-08-18T17:32:17.733Z","dateModified":"2026-08-24T06:59:44.179Z","description":"A custom Java web shell tied to the Clop ransomware/extortion gang has been built specifically for PTC Windchill and FlexPLM servers, exploiting...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/431dea3ea2cf7e8ef8c590a500c7944f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/431dea3ea2cf7e8ef8c590a500c7944f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/clop-created-custom-web-shell-for-windchill-data-theft-attacks-0ioqafvyo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Clop created custom web shell for Windchill data theft attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/clop-created-custom-web-shell-for-windchill-data-theft-attacks-0ioqafvyo#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-12569 and how is it being exploited against PTC Windchill?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-12569 is a critical remote code execution vulnerability in PTC Windchill that the Clop extortion gang has exploited to deploy a custom JSP web shell for data theft. The web shell uses Windchill's own internal classes, including MethodContext, WTConnection, and WTKeyStoreUtil, to decrypt LDAP credentials and steal files from application vaults. PTC began releasing fixes on June 17, and CISA later added the flaw to its Known Exploited Vulnerabilities catalog. Track emerging CVEs like this one on daily.dev before they hit your production Windchill environment."}},{"@type":"Question","name":"What commands does the Clop Windchill web shell support?","acceptedAnswer":{"@type":"Answer","text":"It supports eight single-character commands sent via the HTTP X-windchill-req header: S to steal LDAP and configuration secrets using Windchill's own decryptProperty function, L to map the file vault into flst.txt, D to enumerate directories, G to read a file, R to delete a file, J to load and execute Base64-encoded Java bytecode in memory, O to identify the OS, and E to echo data for verification. Security teams hardening Windchill deployments can follow incident details like these on daily.dev."}},{"@type":"Question","name":"How can I detect if my PTC Windchill server was compromised by this web shell?","acceptedAnswer":{"@type":"Answer","text":"Look for unusual JSP files in Windchill directories, especially any referencing the X-windchill-req header, since the web shell is controlled through this custom HTTP header rather than standard commands. Because the shell queries the database using Windchill's own MethodContext and WTConnection classes under the application's existing identity, normal account-based or new-host detection alerts may not catch it. Rotate the LDAP manager password and other Windchill credentials if compromise is suspected. daily.dev helps defenders keep up with fast-moving exploitation campaigns like this Windchill attack."}}]} ```