Clop Deploys Custom Windchill Web Shell Exploiting CVE-2026-12569
The Clop threat group is likely using a purpose-built web shell to steal data from PTC Windchill and FlexPLM servers. The malware is engineered specifically around Windchill’s internal architecture: it connects to the application database using Windchill’s own built-in mechanisms, decrypts stored credentials, locates documents within file repositories, downloads them, and executes additional Java code directly inside the Windchill process. ReliaQuest discovered the tool while investigating attacks in which threat actors reportedly gained initial access to servers through the critical vulnerability CVE-2026-12569.
CVE-2026-12569: Unauthenticated Remote Code Execution
CVE-2026-12569 permits remote code execution in vulnerable versions of Windchill and FlexPLM without any prior authentication. PTC released patches for the affected systems in June, and on June 25, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog – reserved for flaws with confirmed exploitation in real-world attacks. Federal agencies in the United States were directed to apply the patches within three days.
Linking the Attacks to Clop
In July, reports began surfacing of attacks against internet-facing Windchill and FlexPLM servers. After exploiting CVE-2026-12569, attackers deployed JSP-based web shells – server-side Java pages capable of remotely executing commands and accessing application data. Initially, the campaign’s connection to Clop remained unconfirmed, but several matching indicators later emerged. Ransom demand letters referenced contact addresses associated with Clop’s leak site, and network requests contained the HTTP header X-windchill-req – the same header used by the discovered web shell. The attack’s overall character also mirrors the group’s established playbook: mass-compromise a single widely deployed enterprise product, exfiltrate data, and then extort the affected organizations for payment.
Following Clop’s Established Pattern
Clop has repeatedly targeted the software platforms companies use to store or transfer large volumes of documents. In previous campaigns, the group exploited vulnerabilities in Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U, Cleo, and MOVEit Transfer. For several of these attacks, Clop developed dedicated web shells tailored to the specific product. Following its Accellion FTA breach, the group deployed DEWMODE; when exploiting MOVEit Transfer, it used LEMURLOOT. This new Windchill tool continues that same pattern, but its developers went even deeper by leveraging the application’s internal mechanisms directly.
Built Directly Into Windchill’s Internal APIs
The web shell is written in JavaServer Pages and directly imports Windchill’s own MethodContext, WTConnection, and WTKeyStoreUtil classes. Through these, the malware accesses the database, key store, and other application components without relying on any separate external utilities. Its developers clearly had to study Windchill’s internal APIs, database structure, method of storing encrypted parameters, and file repository organization in depth. A generic, off-the-shelf web shell simply would not contain this level of product-specific knowledge.
Database Access That Blends Into Normal Traffic
The database connection mechanism deserves particular attention. Because the malware uses the MethodContext and WTConnection classes, its queries execute under the identity of the application itself, rather than through any attacker-created account. As a result, malicious operations may appear in database logs tied to Windchill’s ordinary service account. Security tools that primarily watch for new accounts or connections from unfamiliar hosts risk overlooking a portion of this activity entirely.
A Custom Command Protocol via HTTP Headers
To control the web shell, the attackers use their own custom protocol delivered through the HTTP header X-windchill-req. The control sequence consists of eight characters: the first designates the command, while the remaining seven must match a predetermined value. Additional parameters are passed through the X-windchill-prm header. This mechanism allows the operators to issue commands to the malware using ordinary HTTP requests.
Command S: Extracting Windchill Secrets
The S command extracts secrets from Windchill. The web shell reads the ieStructProperties.txt configuration file, accesses the application’s key store, and calls Windchill’s own WTKeyStoreUtil.decryptProperty() function. Through this call, the malware decrypts the LDAP administrator account password and other protected values that Windchill normally stores in encrypted form. ReliaQuest determined that the result is returned to the operator already in plaintext.
Command L: Mapping Files on the Server
The L command helps operators quickly survey what files exist on the server. The web shell queries the Windchill database and retrieves document names, file sizes, and physical storage paths. Analysis revealed queries against the ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem tables. The resulting inventory is saved to a file named flst.txt, after which the operator can download the catalog and select specific documents to steal.
Commands D and G: Direct File Access
Commands D and G provide direct access to files. D lists the contents of a specified directory and allows reading portions of files, while G returns the full contents of a selected file. Command R deletes a specified object. Together, these give the operator the ability to first build a data inventory through Windchill’s own database, then extract the desired documents directly from the underlying file system.
Command J: The Most Powerful Capability
Command J grants the broadest range of capabilities. The web shell accepts a Base64-encoded ZIP archive containing pre-compiled Java classes, loads the embedded bytecode directly into memory, and executes it within the Windchill process. This approach means an additional executable file does not need to be written to disk at all. The operator can extend the already-installed web shell’s capabilities by loading custom Java modules for further network access, establishing persistence within the infrastructure, or other objectives. ReliaQuest also notes that this same mechanism could technically be used to execute data encryption code.
Commands O and E: Supporting Functions
Two additional commands serve supporting roles. O reports the server’s operating system name. E returns whatever data was passed through X-windchill-prm, providing a simple way to verify that the web shell is responding to requests.
A Purpose-Built Extortion Platform
The key distinction between this tool and a generic command shell lies in its ready-made functionality tailored specifically for Windchill. Once installed, the operator never needs to manually search for configuration files, determine the database structure, locate documents, or figure out how secrets are decrypted. The web shell obtains everything it needs through the application’s own internal mechanisms and can begin stealing credentials and files immediately after deployment. ReliaQuest describes it as a specialized platform built for extortion attacks that requires no additional tooling for initial data collection.
Why This Matters: Windchill’s Sensitive Data
Windchill is used for product lifecycle management and storing development-related materials, including engineering data and design documentation. Access to its file repositories can therefore hand attackers valuable corporate intelligence, while stolen credentials compound the damage further. If the obtained credentials are also reused elsewhere within an organization’s systems, attackers may attempt to pivot beyond the initially compromised server.
Recommended Actions
ReliaQuest recommends immediately applying PTC’s patches for CVE-2026-12569, restricting internet access to Windchill interfaces, and auditing application directories for unrecognized JSP files. Organizations should specifically search for files referencing X-windchill-req. If server compromise is confirmed or suspected, simply removing the web shell is not sufficient. The LDAP administrator password and all other secrets stored in Windchill’s key store should be treated as stolen and rotated immediately – including any credentials that have been reused on other servers or databases.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
