InfoSecBulletin Cybersecurity for mankind
The Cl0p ransomware group has listed over 40 organizations that they say they targeted in a recent attack. This attack used a weakness in PTC’s product lifecycle management (PLM) tools, Windchill and FlexPLM.
The vulnerability and its exploitation
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
The exploitation of the vulnerability, tracked as CVE-2026-12569, was discovered in June when CISA added it to its KEV catalog and the vendor warned about attacks aimed at it.
The flaw is that input is not checked properly. This lets a remote attacker, who is not logged in, run their own code using special requests.
Exploitation of the weakness was expected. Police in Germany said they warned groups about possible attacks. It’s worth noting that CVE-2026-12569 is the first ever Windchill vulnerability to be exploited in the wild.
The cybersecurity community noted that the PLM product problem was used in Cl0p ransomware attacks in late July. Cl0p members took advantage of the security issue to put in web shells that let them reach the data of companies using Windchill.
Security firm ReliaQuest reported on Tuesday that Cl0p has been using a custom implant designed to provide “full data theft capability” without requiring additional tools.
“[The web shell] maps sensitive vault data, decrypts every credential in the Windchill keystore, and includes a custom Java class loader that lets Clop execute any additional code inside the application process, extending the shell into an unlimited backdoor for follow-on activity such as lateral movement, ransomware, or persistence,” ReliaQuest explained.
Cl0p attacks
The Cl0p hacking group first only showed part of company names on its site, but on August 12 they began to show full names of victims. Over 40 groups thought to be hit in the Windchill campaign have been named so far.
The hackers wrote down what kind of information and how much they stole from each victim. The stolen data includes databases, project files, backups, photos and other images, engineering papers, blueprints, diagrams, logs, and other company documents. The amount of stolen information per organization is between 1 GB and several terabytes, as reported by the hackers.
The hacked files might have private personal details and important ideas, but a lot of it could be worth less and already available to the public. That’s why many of the affected groups probably said no to paying a ransom.
The list of supposed victims includes big oil and gas company Shell, tech company Philips, finance technology company Fiserv, company Zebra Technologies that provides mobile solutions, industrial equipment maker Ingersoll Rand, software company Toast that makes point-of-sale systems, medical tech leader Mindray, and important Apple camera lens supplier Largan Precision.
GE was first listed too, but now it is gone from the Cl0p website. This might mean the company has paid a ransom or is talking with the hackers again.
Companies like Shell, Philips, Fiserv, and GE said they know about the claims and are looking into them, but none have confirmed a big data breach. Cl0p has done this type of data theft and blackmail before by targeting problems in Oracle E-Business Suite, MOVEit, Cleo, and GoAnywhere software.
Related news:
CL0P Compromised Dozens of Companies and Millions of Americans
