The Clop ransomware operation, tracked as Cl0p, is pursuing internet-accessible PTC Windchill and FlexPLM setups in its newest data theft and extortion drive.

Clop has been leveraging a serious improper input validation flaw listed as CVE-2026-12569. This issue lets attackers run arbitrary code on exposed Windchill and FlexPLM systems.

Cybersecurity firm ReliaQuest noted on Thursday that Clop actors are installing JSP webshells. These tools help pull sensitive information from compromised PLM environments at targeted firms.

"ReliaQuest has seen threat actors actively using CVE-2026-12569, a critical unsafe deserialization flaw (CVSS 9.3) impacting PTC Windchill and FlexPLM. The exploit supports unauthenticated remote code execution plus JSP web shell placement for command execution and product data theft," the firm stated.

"The group behind the incidents is not yet confirmed. Still, the methods match earlier Cl0p efforts against business applications and valuable data stores."

Companies have started receiving extortion messages from support@cryptohox.com, an address tied to the Clop group, as BleepingComputer confirmed. This crew often switches contact details ahead of fresh campaigns.

Active Exploitation Confirmed

PTC issued security fixes for CVE-2026-12569 starting June 17. While it did not verify external exploitation at the time, the vendor shared private guidance and asked clients to scan for signs of compromise.

Following PTC alerts about increased threat activity on June 26, CISA added the flaw to its Known Exploited Vulnerabilities list. Federal agencies were directed to secure their Windchill and FlexPLM instances within three days.

German outlet Heise reported that CVE-2026-12569 triggered urgent steps by local officials. The Federal Office for Information Security contacted PTC customers overnight by email and phone, urging rapid patching.

German authorities acted with similar speed in March over another critical Windchill and FlexPLM issue (CVE-2026-4681) that appeared likely to face exploitation.

ReliaQuest recommended on Thursday that PTC users apply updates to Windchill and FlexPLM systems and shield them behind VPNs or trusted gateways where feasible. Suspected breaches call for isolating servers, gathering forensic evidence, and updating exposed credentials before resuming operations.

A PTC representative could not be reached for comment when BleepingComputer inquired earlier in the week.

PTC Windchill and PTC FlexPLM serve as enterprise tools for Product Lifecycle Management. They help teams track, design, and oversee products from concept through production.

These platforms see broad use among engineering, manufacturing, quality, and supply chain groups in aerospace, defense, automotive, heavy equipment, retail, and medtech fields. PTC reports more than 30,000 global customers, with over 1,500 brands and retailers relying on FlexPLM.

Clop Data Theft History

The Clop group has repeatedly breached enterprise platforms for data theft, hitting tools such as Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer. The MOVEit campaign touched more than 2,770 organizations worldwide.

Most recently, the group used an Oracle EBS zero-day flaw to extract files from numerous entities since early August 2025. Targets included Harvard University, The Washington Post, GlobalLogic, the University of Pennsylvania, Logitech, Estee Lauder, Korean Air, and Envoy Air, an American Airlines unit.

After stealing documents, Clop posts the material on its dark web leak site. Files become available via torrent if victims decline payment.

The U.S. Department of State offers a $10 million reward for details connecting the group to a foreign government.