[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffOyE9DnNB1HSDKb5BpftzEx1yKLNI7I2ZLsbGQmpAC0":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"76c84ce1-197a-4791-9816-f723226dcaad","Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign","cl0p-ransomware-group-names-over-40-victims-of-ptc-windchill-campaign-173d12","The cybercrime gang has listed major companies such as Shell, Philips, Fiserv, Zebra, Mindray, and Largan Precision. The post Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign appeared first on SecurityWeek.","The Cl0p ransomware group has publicly named over 40 organizations as victims of a campaign exploiting a vulnerability in PTC's Windchill and FlexPLM platforms. The attackers used a custom implant to steal sensitive data, including project files, blueprints, and corporate documents, ranging from 1GB to several terabytes per victim. This campaign follows Cl0p's previous data theft operations targeting other software vulnerabilities.","Cl0p ransomware group names over 40 victims of a campaign exploiting PTC Windchill vulnerability.","https:\u002F\u002Fwww.securityweek.com\u002Fcl0p-ransomware-group-names-over-40-victims-of-ptc-windchill-campaign\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F12\u002Fcleo-file-transfer-exploit-attack.jpeg","2026-08-19T11:07:21+00:00","2026-08-19T12:00:16.07014+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"Cl0p","threat_actor",{"name":21,"type":22},"PTC Windchill","product",{"name":24,"type":22},"PTC FlexPLM",{"name":26,"type":27},"PTC","vendor",{"name":29,"type":22},"Oracle E-Business Suite",{"name":31,"type":22},"MOVEit","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":32,"icon":34,"name":35,"slug":36},null,"Ransomware","ransomware",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"cve","CVE-2026-12569","Vulnerability exploited in PTC Windchill and FlexPLM platforms",[26,21,24],{"controls":62,"vendors":145},[63,92,117],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,101,109],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":93,"product_name":98,"url":99,"description":100},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":54,"name":118,"problem":119,"products":120},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[146],{"slug":147,"name":148,"logo_path":149,"roles":150},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png",[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":169},"cl0p-exploits-ptc-windchill-flaw-to-steal-data-from-40-organizations","Cl0p Exploits PTC Windchill Flaw to Steal Data from 40+ Organizations","The Cl0p ransomware group successfully exploited a known vulnerability in PTC's Windchill and FlexPLM platforms, compromising over 40 organizations and exfiltrating highly sensitive engineering and corporate data. The root cause lies in organizations failing to patch enterprise software in a timely manner, leaving internet-facing platforms exposed to well-resourced threat actors. This campaign mirrors Cl0p's previous MOVEit and GoAnywhere operations, demonstrating a repeating pattern of targeting widely-used enterprise software with unpatched vulnerabilities. The theft of blueprints, project files, and proprietary documents represents severe intellectual property loss with long-term competitive and national security implications.",[157,158,159,160,161,162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","CIS Control 3: Data Protection","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST CSF ID.AM-2: Software platforms and applications inventoried","NIST CSF PR.IP-12: Vulnerability management plan","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","GDPR Article 32: Security of processing (for EU-based victims)","GDPR Article 33: Notification of a personal data breach","ITIL Change Management: Emergency change procedures for critical patches",{}]