InfoSecBulletin Cybersecurity for mankind
The Cl0p ransomware group has listed over 40 organizations that they say they targeted in a recent attack. This attack used a weakness in PTC’s product lifecycle management (PLM) tools, Windchill and FlexPLM.
The vulnerability and its exploitation
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
The exploitation of the vulnerability, tracked as CVE-2026-12569, was discovered in June when CISA added it to its KEV catalog and the vendor warned about attacks aimed at it.
The flaw is that input is not checked properly. This lets a remote attacker, who is not logged in, run their own code using special requests.
Exploitation of the weakness was expected. Police in Germany said they warned groups about possible attacks. It’s worth noting that CVE-2026-12569 is the first ever Windchill vulnerability to be exploited in the wild.
The cybersecurity community noted that the PLM product problem was used in Cl0p ransomware attacks in late July. Cl0p members took advantage of the security issue to put in web shells that let them reach the data of companies using Windchill.
Security firm ReliaQuest reported on Tuesday that Cl0p has been using a custom implant designed to provide “full data theft capability” without requiring additional tools.
“[The web shell] maps sensitive vault data, decrypts every credential in the Windchill keystore, and includes a custom Java class loader that lets Clop execute any additional code inside the application process, extending the shell into an unlimited backdoor for follow-on activity such as lateral movement, ransomware, or persistence,” ReliaQuest explained.
Cl0p attacks
The Cl0p hacking group first only showed part of company names on its site, but on August 12 they began to show full names of victims. Over 40 groups thought to be hit in the Windchill campaign have been named so far.
The hackers wrote down what kind of information and how much they stole from each victim. The stolen data includes databases, project files, backups, photos and other images, engineering papers, blueprints, diagrams, logs, and other company documents. The amount of stolen information per organization is between 1 GB and several terabytes, as reported by the hackers.
The hacked files might have private personal details and important ideas, but a lot of it could be worth less and already available to the public. That’s why many of the affected groups probably said no to paying a ransom.
The list of supposed victims includes big oil and gas company Shell, tech company Philips, finance technology company Fiserv, company Zebra Technologies that provides mobile solutions, industrial equipment maker Ingersoll Rand, software company Toast that makes point-of-sale systems, medical tech leader Mindray, and important Apple camera lens supplier Largan Precision.
GE was first listed too, but now it is gone from the Cl0p website. This might mean the company has paid a ransom or is talking with the hackers again.
Companies like Shell, Philips, Fiserv, and GE said they know about the claims and are looking into them, but none have confirmed a big data breach. Cl0p has done this type of data theft and blackmail before by targeting problems in Oracle E-Business Suite, MOVEit, Cleo, and GoAnywhere software.
Related news:
CL0P Compromised Dozens of Companies and Millions of Americans
