--- title: Clop ransomware targets Windchill, FlexPLM in data theft... description: The Clop ransomware gang is actively exploiting CVE-2026-12569, a critical unsafe deserialization vulnerability (CVSS 9.3) in PTC Windchill and FlexPLM... canonical: https://daily.dev/posts/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks-xzhdkyy8m twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Clop ransomware targets Windchill, FlexPLM in data theft attacks | daily.dev og:description: The Clop ransomware gang is actively exploiting CVE-2026-12569, a critical unsafe deserialization vulnerability (CVSS 9.3) in PTC Windchill and FlexPLM... og:url: https://daily.dev/posts/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks-xzhdkyy8m og:image: https://api.daily.dev/og/posts/xZhDkYY8m.png og:image:alt: Clop ransomware targets Windchill, FlexPLM in data theft attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Clop ransomware targets Windchill, FlexPLM in data theft attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 1 upvotes · 0 comments ## Summary The Clop ransomware gang is actively exploiting CVE-2026-12569, a critical unsafe deserialization vulnerability (CVSS 9.3) in PTC Windchill and FlexPLM enterprise PLM platforms. Attackers deploy JSP webshells to exfiltrate sensitive product data from compromised systems. PTC released patches starting June 17, CISA added the flaw to its Known Exploited Vulnerabilities catalog, and German authorities (BSI) issued emergency warnings. Affected companies are receiving extortion emails from a new Clop address. ReliaQuest advises patching immediately, placing systems behind VPNs, isolating compromised servers, and rotating credentials. Clop has a history of similar large-scale data theft campaigns targeting enterprise platforms including MOVEit Transfer, Oracle EBS, and GoAnywhere MFT. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-12569 and how is it being exploited in PTC Windchill and FlexPLM? CVE-2026-12569 is a critical unsafe deserialization vulnerability (CVSS 9.3) in PTC Windchill and FlexPLM that enables unauthenticated remote code execution. Clop ransomware operators are exploiting it to deploy JSP webshells for remote command execution and to exfiltrate sensitive product data for extortion. PTC began releasing patches on June 17, and CISA added the flaw to its Known Exploited Vulnerabilities catalog after confirming active exploitation. _Teams running PTC Windchill or FlexPLM can track emerging exploitation reports like this one on daily.dev._ ### What should I do if my PTC Windchill or FlexPLM instance may be compromised by Clop ransomware? Patch affected Windchill and FlexPLM systems immediately and place them behind VPNs or trusted access gateways. If compromise is suspected, isolate the affected servers, collect forensic artifacts, and rotate any exposed credentials before restoring service, as advised by ReliaQuest following observed Clop exploitation of CVE-2026-12569. _Security practitioners responding to PLM exploitation follow evolving advisories like this via daily.dev._ ### What other enterprise platforms has the Clop ransomware gang targeted in past data theft campaigns? Clop has previously breached Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer, the latter affecting more than 2,770 organizations. Most recently it exploited an Oracle EBS zero-day since early August 2025, hitting Harvard University, The Washington Post, GlobalLogic, the University of Pennsylvania, Logitech, Estée Lauder, Korean Air, and Envoy Air. _Anyone tracking Clop's shifting targets can follow the pattern of enterprise breaches on daily.dev._ ## Similar posts on daily.dev - [Hackers exploit critical PTC Windchill PLM software flaw](https://daily.dev/posts/hackers-exploit-critical-ptc-windchill-plm-software-flaw-rcw1fezbb) · CSO Online · 1 upvotes · 0 comments - [Clop's Oracle EBS rampage reaches Dartmouth College](https://daily.dev/posts/clop-s-oracle-ebs-rampage-reaches-dartmouth-college-ehzpuuxwk) · The Register · 0 upvotes · 0 comments --- Tags: [#ransomware](https://daily.dev/tags/ransomware), [#data-exfiltration](https://daily.dev/tags/data-exfiltration) [View this post on daily.dev](https://daily.dev/posts/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks-xzhdkyy8m) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Clop ransomware targets Windchill, FlexPLM in data theft attacks","url":"https://daily.dev/posts/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks-xzhdkyy8m","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks-xzhdkyy8m"},"datePublished":"2026-07-24T07:41:18.036Z","dateModified":"2026-09-14T06:01:52.941Z","description":"The Clop ransomware gang is actively exploiting CVE-2026-12569, a critical unsafe deserialization vulnerability (CVSS 9.3) in PTC Windchill and FlexPLM...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/281a99bcb4c5e7b0a6d8c0bffc2d4cf5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/281a99bcb4c5e7b0a6d8c0bffc2d4cf5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks-xzhdkyy8m","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ransomware,data-exfiltration","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Clop ransomware targets Windchill, FlexPLM in data theft attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks-xzhdkyy8m#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-12569 and how is it being exploited in PTC Windchill and FlexPLM?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-12569 is a critical unsafe deserialization vulnerability (CVSS 9.3) in PTC Windchill and FlexPLM that enables unauthenticated remote code execution. Clop ransomware operators are exploiting it to deploy JSP webshells for remote command execution and to exfiltrate sensitive product data for extortion. PTC began releasing patches on June 17, and CISA added the flaw to its Known Exploited Vulnerabilities catalog after confirming active exploitation. Teams running PTC Windchill or FlexPLM can track emerging exploitation reports like this one on daily.dev."}},{"@type":"Question","name":"What should I do if my PTC Windchill or FlexPLM instance may be compromised by Clop ransomware?","acceptedAnswer":{"@type":"Answer","text":"Patch affected Windchill and FlexPLM systems immediately and place them behind VPNs or trusted access gateways. If compromise is suspected, isolate the affected servers, collect forensic artifacts, and rotate any exposed credentials before restoring service, as advised by ReliaQuest following observed Clop exploitation of CVE-2026-12569. Security practitioners responding to PLM exploitation follow evolving advisories like this via daily.dev."}},{"@type":"Question","name":"What other enterprise platforms has the Clop ransomware gang targeted in past data theft campaigns?","acceptedAnswer":{"@type":"Answer","text":"Clop has previously breached Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer, the latter affecting more than 2,770 organizations. Most recently it exploited an Oracle EBS zero-day since early August 2025, hitting Harvard University, The Washington Post, GlobalLogic, the University of Pennsylvania, Logitech, Estée Lauder, Korean Air, and Envoy Air. Anyone tracking Clop's shifting targets can follow the pattern of enterprise breaches on daily.dev."}}]} ```