InfoSecBulletin Cybersecurity for mankind
The Cl0p ransomware group has listed over 40 organizations that they say they targeted in a recent attack. This attack used a weakness in PTC’s product lifecycle management (PLM) tools, Windchill and FlexPLM.
The vulnerability and its exploitation
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
The exploitation of the vulnerability, tracked as CVE-2026-12569, was discovered in June when CISA added it to its KEV catalog and the vendor warned about attacks aimed at it.
The flaw is that input is not checked properly. This lets a remote attacker, who is not logged in, run their own code using special requests.
Exploitation of the weakness was expected. Police in Germany said they warned groups about possible attacks. It’s worth noting that CVE-2026-12569 is the first ever Windchill vulnerability to be exploited in the wild.
The cybersecurity community noted that the PLM product problem was used in Cl0p ransomware attacks in late July. Cl0p members took advantage of the security issue to put in web shells that let them reach the data of companies using Windchill.
Security firm ReliaQuest reported on Tuesday that Cl0p has been using a custom implant designed to provide “full data theft capability” without requiring additional tools.
“[The web shell] maps sensitive vault data, decrypts every credential in the Windchill keystore, and includes a custom Java class loader that lets Clop execute any additional code inside the application process, extending the shell into an unlimited backdoor for follow-on activity such as lateral movement, ransomware, or persistence,” ReliaQuest explained.
Cl0p attacks
The Cl0p hacking group first only showed part of company names on its site, but on August 12 they began to show full names of victims. Over 40 groups thought to be hit in the Windchill campaign have been named so far.
The hackers wrote down what kind of information and how much they stole from each victim. The stolen data includes databases, project files, backups, photos and other images, engineering papers, blueprints, diagrams, logs, and other company documents. The amount of stolen information per organization is between 1 GB and several terabytes, as reported by the hackers.
The hacked files might have private personal details and important ideas, but a lot of it could be worth less and already available to the public. That’s why many of the affected groups probably said no to paying a ransom.
The list of supposed victims includes big oil and gas company Shell, tech company Philips, finance technology company Fiserv, company Zebra Technologies that provides mobile solutions, industrial equipment maker Ingersoll Rand, software company Toast that makes point-of-sale systems, medical tech leader Mindray, and important Apple camera lens supplier Largan Precision.
GE was first listed too, but now it is gone from the Cl0p website. This might mean the company has paid a ransom or is talking with the hackers again.
Companies like Shell, Philips, Fiserv, and GE said they know about the claims and are looking into them, but none have confirmed a big data breach. Cl0p has done this type of data theft and blackmail before by targeting problems in Oracle E-Business Suite, MOVEit, Cleo, and GoAnywhere software.
Related news:
CL0P Compromised Dozens of Companies and Millions of Americans
