InfoSecBulletin Cybersecurity for mankind
The Cl0p ransomware group has listed over 40 organizations that they say they targeted in a recent attack. This attack used a weakness in PTC’s product lifecycle management (PLM) tools, Windchill and FlexPLM.
The vulnerability and its exploitation
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
The exploitation of the vulnerability, tracked as CVE-2026-12569, was discovered in June when CISA added it to its KEV catalog and the vendor warned about attacks aimed at it.
The flaw is that input is not checked properly. This lets a remote attacker, who is not logged in, run their own code using special requests.
Exploitation of the weakness was expected. Police in Germany said they warned groups about possible attacks. It’s worth noting that CVE-2026-12569 is the first ever Windchill vulnerability to be exploited in the wild.
The cybersecurity community noted that the PLM product problem was used in Cl0p ransomware attacks in late July. Cl0p members took advantage of the security issue to put in web shells that let them reach the data of companies using Windchill.
Security firm ReliaQuest reported on Tuesday that Cl0p has been using a custom implant designed to provide “full data theft capability” without requiring additional tools.
“[The web shell] maps sensitive vault data, decrypts every credential in the Windchill keystore, and includes a custom Java class loader that lets Clop execute any additional code inside the application process, extending the shell into an unlimited backdoor for follow-on activity such as lateral movement, ransomware, or persistence,” ReliaQuest explained.
Cl0p attacks
The Cl0p hacking group first only showed part of company names on its site, but on August 12 they began to show full names of victims. Over 40 groups thought to be hit in the Windchill campaign have been named so far.
The hackers wrote down what kind of information and how much they stole from each victim. The stolen data includes databases, project files, backups, photos and other images, engineering papers, blueprints, diagrams, logs, and other company documents. The amount of stolen information per organization is between 1 GB and several terabytes, as reported by the hackers.
The hacked files might have private personal details and important ideas, but a lot of it could be worth less and already available to the public. That’s why many of the affected groups probably said no to paying a ransom.
The list of supposed victims includes big oil and gas company Shell, tech company Philips, finance technology company Fiserv, company Zebra Technologies that provides mobile solutions, industrial equipment maker Ingersoll Rand, software company Toast that makes point-of-sale systems, medical tech leader Mindray, and important Apple camera lens supplier Largan Precision.
GE was first listed too, but now it is gone from the Cl0p website. This might mean the company has paid a ransom or is talking with the hackers again.
Companies like Shell, Philips, Fiserv, and GE said they know about the claims and are looking into them, but none have confirmed a big data breach. Cl0p has done this type of data theft and blackmail before by targeting problems in Oracle E-Business Suite, MOVEit, Cleo, and GoAnywhere software.
Related news:
CL0P Compromised Dozens of Companies and Millions of Americans
