InfoSecBulletin Cybersecurity for mankind
The Cl0p ransomware group has listed over 40 organizations that they say they targeted in a recent attack. This attack used a weakness in PTC’s product lifecycle management (PLM) tools, Windchill and FlexPLM.
The vulnerability and its exploitation
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
The first zero-click worm to spread through WeChat calls across iOS and Android
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
The exploitation of the vulnerability, tracked as CVE-2026-12569, was discovered in June when CISA added it to its KEV catalog and the vendor warned about attacks aimed at it.
The flaw is that input is not checked properly. This lets a remote attacker, who is not logged in, run their own code using special requests.
Exploitation of the weakness was expected. Police in Germany said they warned groups about possible attacks. It’s worth noting that CVE-2026-12569 is the first ever Windchill vulnerability to be exploited in the wild.
The cybersecurity community noted that the PLM product problem was used in Cl0p ransomware attacks in late July. Cl0p members took advantage of the security issue to put in web shells that let them reach the data of companies using Windchill.
Security firm ReliaQuest reported on Tuesday that Cl0p has been using a custom implant designed to provide “full data theft capability” without requiring additional tools.
“[The web shell] maps sensitive vault data, decrypts every credential in the Windchill keystore, and includes a custom Java class loader that lets Clop execute any additional code inside the application process, extending the shell into an unlimited backdoor for follow-on activity such as lateral movement, ransomware, or persistence,” ReliaQuest explained.
Cl0p attacks
The Cl0p hacking group first only showed part of company names on its site, but on August 12 they began to show full names of victims. Over 40 groups thought to be hit in the Windchill campaign have been named so far.
The hackers wrote down what kind of information and how much they stole from each victim. The stolen data includes databases, project files, backups, photos and other images, engineering papers, blueprints, diagrams, logs, and other company documents. The amount of stolen information per organization is between 1 GB and several terabytes, as reported by the hackers.
The hacked files might have private personal details and important ideas, but a lot of it could be worth less and already available to the public. That’s why many of the affected groups probably said no to paying a ransom.
The list of supposed victims includes big oil and gas company Shell, tech company Philips, finance technology company Fiserv, company Zebra Technologies that provides mobile solutions, industrial equipment maker Ingersoll Rand, software company Toast that makes point-of-sale systems, medical tech leader Mindray, and important Apple camera lens supplier Largan Precision.
GE was first listed too, but now it is gone from the Cl0p website. This might mean the company has paid a ransom or is talking with the hackers again.
Companies like Shell, Philips, Fiserv, and GE said they know about the claims and are looking into them, but none have confirmed a big data breach. Cl0p has done this type of data theft and blackmail before by targeting problems in Oracle E-Business Suite, MOVEit, Cleo, and GoAnywhere software.
Related news:
CL0P Compromised Dozens of Companies and Millions of Americans
