Actor Profile

Clop (also tracked as Cl0p) is a financially motivated ransomware and data extortion gang with a well-established pattern of targeting enterprise software platforms to steal sensitive data and extort victims. The group operates by exploiting vulnerabilities in Internet-exposed enterprise applications, particularly file transfer and product lifecycle management systems, to gain initial access and exfiltrate high-value data. Clop does not typically deploy ransomware encryption in these campaigns; instead, they focus on data theft and extortion, threatening to publish stolen information on their dark web leak site if victims refuse payment. The U.S. Department of State offers a $10 million reward for information linking Clop's operations to a foreign government, indicating suspected nation-state connections.

TTPs (Tactics, Techniques, Procedures)

Clop exploits CVE-2026-12569, a critical unsafe deserialization vulnerability (CVSS 9.3) in PTC Windchill and FlexPLM, enabling unauthenticated remote code execution (T1190: Exploit Public-Facing Application). Following exploitation, operators deploy JSP webshells for persistence and remote command execution (T1505.003: Web Shell). The group conducts data exfiltration of sensitive product lifecycle management data (T1041: Exfiltration Over C2 Channel). For extortion, Clop uses compromised email accounts to send threatening messages to hundreds of employees within targeted organizations (T1566: Phishing for initial contact, T1589: Gather Victim Identity Information). The group rotates email addresses between campaigns to evade detection and maintain operational security. Stolen data is published on a dark web leak site and distributed via Torrent if ransom demands are not met.

Targets & Patterns

Clop targets organizations in the manufacturing, aerospace, defense, automotive, heavy machinery, retail, and medical technology sectors—industries that rely heavily on Product Lifecycle Management (PLM) platforms like PTC Windchill and FlexPLM. These systems contain highly sensitive intellectual property, product designs, engineering specifications, and supply chain data, making them high-value targets for data extortion. The current campaign focuses on Internet-exposed instances of PTC products, affecting companies globally. PTC reports over 30,000 customers worldwide, including more than 1,500 using FlexPLM. Clop's targeting pattern demonstrates a preference for enterprise platforms with broad deployment across high-profile organizations, where data theft can yield significant extortion leverage. The group's victim selection emphasizes organizations with critical operational dependencies on the compromised platforms and valuable proprietary information.

Historical Context

Clop has an extensive history of exploiting zero-day and n-day vulnerabilities in enterprise file transfer and management platforms. Previous campaigns include attacks on Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and the MOVEit Transfer campaign that affected over 2,770 organizations worldwide. Most recently, in August 2025, Clop exploited an Oracle EBS zero-day vulnerability, compromising Harvard University, The Washington Post, GlobalLogic, University of Pennsylvania, Logitech, Estée Lauder, Korean Air, and American Airlines subsidiary Envoy Air. The current PTC Windchill/FlexPLM campaign follows the same operational playbook observed in the Oracle EBS campaign, including the use of compromised email accounts for mass extortion messaging to hundreds of employees per organization. ReliaQuest noted that the tradecraft in this campaign shares characteristics with previous Clop operations targeting enterprise applications and high-value data repositories. German authorities previously responded with similar urgency in March 2026 to CVE-2026-4681, another critical Windchill/FlexPLM vulnerability, suggesting ongoing threat actor interest in these platforms.

Defensive Recommendations

  • Immediately patch PTC Windchill and FlexPLM systems to address CVE-2026-12569 (CVSS 9.3) following PTC's June 17 security advisory and remediation guidance
  • Remove PTC Windchill and FlexPLM instances from direct Internet exposure; place behind VPNs or trusted access gateways to prevent exploitation of T1190 (Exploit Public-Facing Application)
  • Hunt for JSP webshells (T1505.003) in Windchill/FlexPLM web directories using file integrity monitoring and review web server logs for suspicious POST requests and unusual file uploads
  • Monitor for indicators of compromise provided by PTC in their private advisory, including anomalous authentication patterns, unexpected outbound connections, and large data transfers from PLM systems
  • If compromise is suspected, immediately isolate affected servers, collect forensic artifacts (memory dumps, disk images, logs), rotate all credentials with access to the PLM environment, and review email logs for mass extortion messages originating from compromised accounts