[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLtHRQQCuYCnU7RIIlh4-Mc-ticqXE78RrNvkV8QQHx8":3},{"article":4,"iocs":54,"watch_terms":66,"solutions":67,"lesson":163},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"fecffcc2-1ec8-493f-8fe8-6ee4c3ae0c83","Clop ransomware targets Windchill, FlexPLM in data theft attacks","clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks-afe4a1","The Clop ransomware gang (also tracked as Cl0p) is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign. [...]","The Clop ransomware gang is actively exploiting a critical vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM software to gain unauthorized access and exfiltrate sensitive data. This vulnerability allows for remote code execution and the deployment of web shells, enabling data theft and subsequent extortion. Both CISA and German authorities have issued urgent warnings and directives for affected organizations to patch their systems.","Clop ransomware gang targets Windchill and FlexPLM via CVE-2026-12569 for data theft.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fclop-ransomware-targets-windchill-flexplm-in-data-theft-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F05\u002FHackerbox.jpg","2026-07-24T07:36:39+00:00","2026-07-24T08:00:22.09195+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"Clop","threat_actor",{"name":21,"type":22},"Windchill","product",{"name":24,"type":22},"FlexPLM",{"name":26,"type":27},"PTC","vendor",{"name":29,"type":30},"Clop ransomware attacks","campaign","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":31,"icon":33,"name":34,"slug":35},null,"Ransomware","ransomware",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,63],{"type":56,"value":57,"context":58},"cve","CVE-2026-12569","Vulnerability exploited by Clop for RCE and data exfiltration in PTC Windchill and FlexPLM.",{"type":60,"value":61,"context":62},"email","support@cryptohox.com","Email address used by Clop gang for extortion.",{"type":56,"value":64,"context":65},"CVE-2026-4681","Previously identified critical flaw in PTC Windchill and FlexPLM.",[26,21,24],{"controls":68,"vendors":156},[69,98,127],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":99,"name":100,"problem":101,"products":102},"patch-management","Automated patch management","Known holes get closed in days, not months.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":128,"name":129,"problem":130,"products":131},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[132,140,148],{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[157],{"slug":158,"name":159,"logo_path":160,"roles":161},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png",[162],"reported_by",{"slug":164,"title":165,"body":166,"framework_refs":167,"framework_notes":178},"clop-ransomware-exploits-unpatched-ptc-software-for-data-extortion","Clop Ransomware Exploits Unpatched PTC Software for Data Extortion","The Clop ransomware gang is actively exploiting CVE-2026-12569, a critical remote code execution vulnerability in PTC Windchill and FlexPLM — platforms widely used in product lifecycle management. By deploying web shells after initial exploitation, attackers gain persistent access to exfiltrate sensitive engineering and business data before demanding ransom. The fact that both CISA and German authorities issued urgent warnings indicates this is a widespread, actively weaponized threat. Organizations running unpatched versions of these systems face not only data theft but also significant regulatory and operational consequences. This incident underscores that delays in patching internet-facing enterprise software directly translate into exploitable attack windows for sophisticated threat actors.",[168,169,170,171,172,173,174,175,176,177],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-7: Boundary Protection (Network Segmentation)","CISA KEV Catalog: Known Exploited Vulnerabilities Directive (BOD 22-01)","GDPR Article 32: Security of Processing (data exfiltration risk)","ITIL 4: Change Enablement — Emergency Change Procedures",{}]