[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuKZB2SibrdpATacfsdVFOcgrPIlwQhNCOhgxAIWsgOc":3},{"article":4,"iocs":56,"watch_terms":61,"solutions":62,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"bf0a19fd-17d7-4193-8473-265954a4e260","Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data","clop-linked-windchill-web-shell-decrypts-credentials-and-maps-engineering-data-0a363b","A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management (PLM) software, according to new findings from ReliaQuest. The cybersecurity company characterized the web shell as a fully equipped extortion platform capable of mapping sensitive vault","A custom JavaServer Pages (JSP) web shell, linked to the Clop ransomware operation, has been discovered targeting PTC Windchill and FlexPLM servers. This bespoke tool exploits a critical vulnerability (CVE-2026-12569) to decrypt credentials from the Windchill keystore, map sensitive data, and establish a backdoor for post-exploitation activities like lateral movement and data exfiltration. The shell's deep integration with the application's structure allows for rapid access to proprietary engineering data and administrative credentials, including LDAP passwords, potentially leading to enterprise-wide compromise.","Clop ransomware uses custom web shell to steal credentials from PTC Windchill servers.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fclop-linked-windchill-web-shell.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEit3cCqpn48W_lqEDCb9ewKFToGQcvhUjO939N0Gja-aTvCvRTz8kdOPZG1bhyphenhyphenED2XNeB82rjCIeVO3Nw9akDlMnQZqc7keiel8H82zgtf1A7fhb6DP3z6Qh3Ehk6AGrMt77rXkoNhLaDeEl692kDHAHVsNb7AOcDxpsavM0Hj9TZRLLJsuQ-OT3oQOvFMi\u002Fs1600\u002Fptc.jpg","2026-08-19T05:39:25+00:00","2026-08-19T10:00:07.289124+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"PTC Windchill","product",{"name":21,"type":19},"FlexPLM",{"name":23,"type":24},"Clop","threat_actor",{"name":26,"type":27},"LDAP","technology",{"name":29,"type":27},"Active Directory","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":52},{"id":53,"icon":32,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57],{"type":58,"value":59,"context":60},"cve","CVE-2026-12569","Critical security flaw in PTC Windchill and FlexPLM servers",[18,21],{"controls":63,"vendors":151},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":94,"name":95,"problem":96,"products":97},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":123,"name":124,"problem":125,"products":126},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[152],{"slug":153,"name":154,"logo_path":155,"roles":156},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png",[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":176},"clop-linked-web-shell-exploits-windchill-plm-to-steal-engineering-credentials","Clop-Linked Web Shell Exploits Windchill PLM to Steal Engineering Credentials","A sophisticated JSP web shell tied to the Clop ransomware group is actively exploiting CVE-2026-12569 in PTC Windchill and FlexPLM platforms — systems that store highly sensitive proprietary engineering and manufacturing data. The attack chain allows threat actors to decrypt credentials directly from the application keystore, including LDAP passwords, enabling rapid lateral movement across the enterprise. This matters because PLM systems are often trusted, internally-facing applications that receive less aggressive patch scrutiny than perimeter-facing assets, creating a dangerous blind spot. The ability to harvest administrative credentials from within the application itself means a single unpatched server can cascade into a full enterprise compromise.",[163,164,165,166,167,168,169,170,171,172,173,174,175],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40: Guide to Enterprise Patch Management","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST SI-3: Malicious Code Protection","NIST AU-12: Audit Record Generation","NIST SC-7: Boundary Protection (Network Segmentation)","MITRE ATT&CK T1505.003: Server Software Component – Web Shell","MITRE ATT&CK T1552.001: Unsecured Credentials: Credentials In Files","GDPR Article 32: Security of Processing (for organizations handling EU data)",{}]