Actor Profile

Clop is a financially motivated ransomware and extortion gang known for mass-exploitation campaigns targeting enterprise file-sharing and collaboration platforms. The group operates a data leak site where they publish stolen data to pressure victims into paying ransoms. Clop has demonstrated sophisticated technical capabilities, including developing application-specific tooling and rapidly weaponizing zero-day vulnerabilities in widely deployed enterprise software. Attribution to Clop is based on extortion emails containing addresses from the gang's data leak site, previously observed X-windchill-req headers, and TTPs consistent with prior campaigns.

TTPs (Tactics, Techniques, Procedures)

Initial access via exploitation of CVE-2026-12569, a critical remote code execution vulnerability in PTC Windchill. Post-exploitation involves deployment of a custom JavaServer Pages (JSP) web shell with Windchill-specific functionality. The web shell imports native Windchill classes (MethodContext, WTConnection, WTKeyStoreUtil) to abuse legitimate application functions for credential decryption, database enumeration, and file exfiltration. Command-and-control uses custom protocol via HTTP X-windchill-req header. Capabilities include credential theft via WTKeyStoreUtil.decryptProperty() to decrypt LDAP manager passwords, file vault enumeration through direct database queries (ApplicationData, FVITEM, FVMOUNT, MasteredOnReplicaItem tables), file retrieval and deletion, in-memory Java bytecode execution, and data staging to flst.txt. Activity runs under application's service identity to evade detection. Aligns with T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1555 (Credentials from Password Stores), T1005 (Data from Local System), T1027 (Obfuscated Files or Information), and T1059.007 (JavaScript).

Targets & Patterns

Clop targets organizations in the manufacturing and engineering sectors that deploy PTC Windchill and FlexPLM servers—product lifecycle management (PLM) platforms containing sensitive intellectual property, engineering designs, and proprietary data. The gang focuses on enterprise platforms with high-value data repositories that enable mass-exploitation at scale. Previous campaigns targeted Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer, with the MOVEit campaign alone affecting over 2,770 organizations worldwide. The pattern demonstrates Clop's preference for widely deployed file-sharing and collaboration platforms where a single vulnerability can yield numerous victims. Extortion emails are sent to hundreds of employees at affected organizations, maximizing pressure on victims to pay ransoms before data is published on the gang's leak site.

Historical Context

This campaign represents an evolution in Clop's established mass-exploitation playbook. Unlike previous operations using generic or repurposed web shells, the Windchill web shell demonstrates application-specific development requiring detailed knowledge of Windchill's internal APIs, database schema, keystore mechanisms, and file-vault structure. The activity follows Clop's July 2026 data theft extortion campaign exploiting CVE-2026-12569 in PTC Windchill and FlexPLM servers. Historical campaigns include Accellion FTA (2020-2021), GoAnywhere MFT (2023), SolarWinds Serv-U FTP, Cleo, and the high-impact MOVEit Transfer campaign affecting thousands of organizations globally. The consistent targeting of enterprise file-sharing platforms and rapid exploitation of disclosed vulnerabilities has become a signature Clop operational pattern. PTC released fixes for CVE-2026-12569 on June 17, 2026, and CISA added it to the Known Exploited Vulnerabilities catalog following reports of active exploitation.

Defensive Recommendations

  • Immediately patch PTC Windchill and FlexPLM servers to remediate CVE-2026-12569; prioritize internet-facing instances
  • Hunt for unusual JSP files in Windchill directories, especially those containing references to 'X-windchill-req' header or importing MethodContext, WTConnection, WTKeyStoreUtil classes
  • Monitor for anomalous HTTP requests with custom X-windchill-req headers (8-character values) and investigate database queries attributed to Windchill's service identity accessing LDAP configuration, ApplicationData, FVITEM, FVMOUNT, or MasteredOnReplicaItem tables
  • Rotate LDAP manager passwords and all Windchill credentials on systems suspected of compromise; treat all stored credentials as potentially decrypted and exfiltrated
  • Implement file integrity monitoring on Windchill web directories to detect unauthorized JSP deployment (T1505.003); monitor for creation of staging files like flst.txt and in-memory Java class loading activity