[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGktyOxFnmbpGWQaWAFQ0FV0PBX_GRsKbMdro1-9S-Lw":3},{"article":4,"iocs":55,"watch_terms":70,"solutions":71,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"835a8eac-9b7b-4c3f-84e0-6bf869c8128e","Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE","cl0p-affiliates-target-internet-exposed-ptc-windchill-and-flexplm-with-unauthent-2771e2","Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. \"Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling","Threat actors linked to the Cl0p ransomware campaign are exploiting unauthenticated remote code execution vulnerabilities in internet-exposed PTC Windchill and FlexPLM deployments. Attackers chain two vulnerabilities to gain access, deploy web shells, and steal sensitive product data, targeting manufacturing, automotive, aerospace, and retail sectors. This campaign leverages CVE-2026-12569, a critical flaw already on CISA's KEV catalog, and a separate information disclosure defect in FlexPLM.","Cl0p affiliates exploit PTC Windchill and FlexPLM flaws for RCE and data extortion.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fcl0p-affiliates-target-internet-exposed.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiIGAlXgFCqm8atTe__HpWBiCWISmrPOazxOVBMF-_YNrP2goBbW_4PSwGzw1Ndyue4qrnQnqrQyAR4DTaAdaiJPlVUZi7M_iceb4fqofWK0sGRLO9CHnj0lngtxdlC-tKqrppqFaKIkct2vOtGn_o5kbNa4fj-dutt8PMjiO5TVBw895aLg0TOJb8TKKtv\u002Fs1600\u002Fcyberattack.jpg","2026-07-25T10:14:03+00:00","2026-07-25T12:00:10.833393+00:00",9,[17,20,23,25,28,30],{"name":18,"type":19},"Cl0p","threat_actor",{"name":21,"type":22},"PTC Windchill","product",{"name":24,"type":22},"PTC FlexPLM",{"name":26,"type":27},"Graceful Spider","campaign",{"name":29,"type":27},"Lace Tempest",{"name":31,"type":27},"FIN11","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":32,"icon":34,"name":35,"slug":36},null,"Ransomware","ransomware",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,62,64,66],{"type":57,"value":58,"context":59},"ip","216.152.148.54","Indicator of compromise shared by Ransom-ISAC and PTC.",{"type":57,"value":61,"context":59},"216.152.151.204",{"type":57,"value":63,"context":59},"104.243.35.63",{"type":57,"value":65,"context":59},"5.180.41.35",{"type":67,"value":68,"context":69},"cve","CVE-2026-12569","Critical security flaw in PTC Windmill exploited by attackers.",[21,24],{"controls":72,"vendors":160},[73,102,131],{"slug":74,"name":75,"problem":76,"products":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":103,"name":104,"problem":105,"products":106},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png","censys-external-exposure-management","Censys External Exposure Management","https:\u002F\u002Fcensys.com\u002Fsolutions\u002Fexternal-exposure-management","External attack surface discovery based on continuous internet-wide scanning.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png","watchtowr-platform","watchTowr Platform","https:\u002F\u002Fwatchtowr.com\u002Fplatform\u002F","Continuous discovery of internet-facing assets, with automated testing for exploitable vulnerabilities.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","attack-surface-intelligence","Attack Surface Intelligence","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fattack-surface-intelligence","External attack surface management that discovers internet-facing assets and prioritises their exposures.",{"slug":132,"name":133,"problem":134,"products":135},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[136,144,152],{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[],{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":177},"cl0p-exploits-unpatched-ptc-windchill-flexplm-rce-flaws-in-manufacturing-sector","Cl0p Exploits Unpatched PTC Windchill & FlexPLM RCE Flaws in Manufacturing Sector","Threat actors linked to the Cl0p ransomware group are actively chaining unauthenticated remote code execution vulnerabilities in PTC Windchill and FlexPLM — enterprise product lifecycle management platforms — to deploy web shells and exfiltrate sensitive design and product data. The root cause is a failure to patch known critical vulnerabilities in internet-exposed systems, compounded by the absence of network segmentation that would limit attacker access after initial compromise. CVE-2026-12569 was already listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning affected organizations had explicit warning and a federal mandate to remediate. This campaign is particularly damaging in critical manufacturing, aerospace, and automotive sectors where stolen product data can have severe competitive, regulatory, and national security implications.",[166,167,168,169,170,171,172,173,174,175,176],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SC-7: Boundary Protection","NIST CSF ID.AM-1: Asset Inventory","CISA KEV Catalog Binding Operational Directive (BOD 22-01)","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","IEC 62443-3-3: Industrial Automation Network Segmentation","GDPR Article 32: Security of Processing (for EU-based manufacturers handling personal data)",{}]