Full research report

Philips and GE investigating Clop ransomware data theft claims

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-12569 is a critical unauthenticated remote code execution vulnerability in PTC's Windchill and FlexPLM platforms, likely exploited by Clop affiliates as a zero-day from early June 2026 — two weeks before PTC released patches on 17 June and weeks before CISA's KEV addition on 25 June. The attack chain is technically sophisticated, chaining a pre-authentication information disclosure flaw in FlexPLM's WSDL endpoint with a deserialization weakness in the Windchill login servlet to achieve code execution without any valid credentials. Post-exploitation tradecraft is consistent with prior Clop campaigns: JSP webshells for persistent access, `flst.txt` artefacts for filesystem enumeration, and mass exfiltration of high-value engineering intellectual property — blueprints, project plans, and technical drawings — from aerospace, automotive, medtech, and manufacturing organisations. Philips has confirmed a contained internal server breach; GE and Shell remain in the investigation phase without breach confirmation. The incident follows Clop's established pattern of exploiting widely-deployed enterprise platforms at scale before defenders can respond, mirroring prior campaigns against MOVEit, GoAnywhere, Cleo, and Oracle EBS.

What happened

The Clop ransomware group listed 43 organisations on its data-leak site in mid-August 2026, claiming to have stolen sensitive engineering data by exploiting CVE-2026-12569, a critical unauthenticated remote code execution vulnerability in PTC Windchill and FlexPLM. Philips confirmed a breach of an internal enterprise server, stating it was contained with no customer impact. GE said it was assessing the claim, while Shell confirmed it was investigating after Clop claimed 89 GB of stolen data. Ransom-ISAC and ReliaQuest assessed that Clop affiliates likely exploited the vulnerability as a zero-day from early June 2026, approximately two weeks before PTC released patches on 17 June.

Affected scope

PTC Windchill and FlexPLM customers running instances prior to version 11.0 M030; PTC reports more than 30,000 global customers across aerospace, defence, automotive, heavy machinery, medtech, and retail/apparel sectors. Named victims include Philips, General Electric, and Shell; Clop has listed 43 victims in total, a figure that has not been independently verified.

Technical assessment

CVE-2026-12569 (CVSS 9.3) is an improper input validation flaw rooted in deserialization of untrusted data. Ransom-ISAC and ReliaQuest report that Clop affiliates chained a pre-authentication information disclosure weakness in the FlexPLM WSDL endpoint with a deserialization flaw in the Windchill login servlet to achieve unauthenticated remote code execution. Attackers then deployed JSP webshells in the `/Windchill/login/` directory for persistent access, followed by filesystem enumeration and large-scale staging and exfiltration of engineering design files, blueprints, and project data.

Recommended defensive actions

  1. Patch PTC Windchill and FlexPLM to version 11.0 M030 or later immediately, prioritising internet-exposed instances.
  2. Hunt for JSP webshells matching the filename pattern `/Windchill/login/[0-9a-fA-F]{6,16}.jsp` across application directories.
  3. Block outbound connections to the confirmed threat-actor command-and-control address 5.180.41.35 at the network perimeter.
  4. Search for the post-exploitation reconnaissance artefact `flst.txt` in `/tmp` directories and Windchill working directories as an indicator of compromise.
  5. Audit internet exposure of all Windchill and FlexPLM interfaces; restrict access to trusted IP ranges where public-facing deployment is not operationally required.
  6. Monitor web server and application logs for anomalous POST requests to `/Windchill/login/*.jsp` paths.

Uncertainties and evidence gaps

  • The volume and content of data stolen from GE has not been independently confirmed; GE has not acknowledged a breach, only an assessment.
  • Whether Clop exploited CVE-2026-12569 as a true zero-day before the 17 June patch release, or only after, has not been definitively confirmed by a vendor or government source — the zero-day assessment comes from Ransom-ISAC, not PTC or CISA.
  • The full list of 43 victims originates exclusively from Clop's own leak-site claims and has not been independently verified by any third party.
  • No public proof-of-concept exploit code for CVE-2026-12569 has been confirmed, though in-the-wild exploitation is established.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated, remote; requires network access to an internet-exposed PTC Windchill or FlexPLM web interface
ComponentPTC Windchill login servlet and FlexPLM WSDL endpoint
MechanismChained pre-authentication information disclosure in the FlexPLM WSDL endpoint with deserialization of attacker-controlled data in the Windchill login servlet, bypassing authentication to achieve server-side code execution
ImpactUnauthenticated remote code execution leading to persistent webshell implantation, large-scale data staging, and exfiltration of sensitive engineering and proprietary design files
DetectionPOST requests to `/Windchill/login/*.jsp`; presence of hex-named JSP files (6–16 character filenames) in the Windchill login directory; `flst.txt` artefact in `/tmp` or Windchill directories; outbound connections to 5.180.41.35
MitigationApply PTC patch to Windchill and FlexPLM version 11.0 M030 or later; remove or restrict internet exposure of PLM interfaces; block confirmed C2 address 5.180.41.35
Exploitation status

Confirmed active exploitation in the wild; Clop affiliates have deployed JSP webshells against internet-exposed PTC Windchill and FlexPLM instances since early June 2026, with CISA adding CVE-2026-12569 to its Known Exploited Vulnerabilities catalogue on 25 June 2026, mandating federal remediation within three days. No public proof-of-concept exploit code has been identified.

Research process

The investigation began with Clop's claims listing Philips, GE, and Shell among 43 victims of a data-theft campaign exploiting CVE-2026-12569 in PTC Windchill. The BleepingComputer article confirmed Philips acknowledged a contained internal server breach and GE an active assessment. Three independent technical sources — The Hacker News reporting on the CISA KEV addition, SecurityWeek on exploitation attribution, and Help Net Security on webshell IOCs — corroborated the attack chain, Clop attribution, and concrete defender signals. Searches for public proof-of-concept code returned no confirmed result, establishing an absence that is itself a relevant risk-calibration finding.

  1. What companies were targeted, what are their public statements, and what data does Clop claim to have stolen?
    Fetched BleepingComputer primary reporting article
    bleepingcomputer.com ↗

    Philips confirmed a contained breach of an internal enterprise server with no customer impact; GE is assessing the claim; Shell confirmed an investigation after Clop claimed 89 GB stolen. Clop listed 43 total victims; claimed data includes backups, project plans, blueprints, drawings, and facility photographs.

    why Establishes corporate acknowledgements, scope of Clop's claims, and the categories of data allegedly stolen, which require independent technical corroboration.

  2. When did CISA confirm active exploitation, and what are the official webshell IOCs?
    Fetched The Hacker News article on CISA's KEV addition for CVE-2026-12569
    thehackernews.com ↗

    CISA added CVE-2026-12569 to the KEV catalogue on 25 June 2026 with a federal remediation deadline of 28 June. The vulnerability is CVSS 9.3, unauthenticated RCE via deserialization. Webshells follow hex-pattern naming in `/Windchill/login/`.

    why Government-level confirmation of active exploitation transforms a threat-actor claim into a verified, government-endorsed incident; the IOC patterns are immediately actionable for defenders.

  3. What is the specific exploitation chain and which threat actor is responsible?
    Fetched SecurityWeek article on the ransomware campaign exploiting PTC Windchill
    securityweek.com ↗

    ReliaQuest and Ransom-ISAC attributed the campaign to a Clop affiliate. The chain combines a pre-authentication FlexPLM WSDL information disclosure with a Windchill login-servlet deserialization flaw. Targeted sectors: aerospace, automotive, manufacturing, retail/apparel.

    why Provides independent technical corroboration of the exploitation chain from two security organisations separate from the victim companies, confirming Clop attribution and sector scope.

  4. What defender-actionable IOCs and post-exploitation behaviours can be hunted in enterprise environments?
    Fetched Help Net Security article on JSP webshell deployment against Windchill
    helpnetsecurity.com ↗

    Webshells use 6–16 hex-character filenames in `/Windchill/login/`; `flst.txt` artefact appears in `/tmp` after filesystem enumeration; confirmed C2 address 5.180.41.35; post-exploitation targets engineering and design data.

    why Converts the abstract vulnerability and campaign into concrete, prioritised detection and threat-hunting signals essential for defensive triage.

  5. Is any public proof-of-concept exploit code available that would lower the barrier to entry for other threat actors?
    Searched for public PoC exploit code for CVE-2026-12569 on GitHub and security research sites

    No public proof-of-concept exploit code for CVE-2026-12569 was identified. General CVE PoC repository sites were returned but none confirmed a specific PoC for this vulnerability.

    why Absence of a confirmed public PoC is a material risk-calibration finding; current exploitation appears limited to the Clop affiliate group rather than being broadly accessible to lower-capability actors.

Named in this story
ActorsClop (Cl0p)
MalwareJSP webshell
TargetsPhilipsGeneral Electric (GE)ShellPTC Windchill and FlexPLM customers across aerospace, automotive, medtech, manufacturing, and retail sectors
Related CVEs CVE-2026-12569

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok8 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
CISA KEVkev ok1666 records Primary evidence1 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5324 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok685 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1009 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok9 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Vulnerability & exploitation2
CVE-2026-12569 CISA KEV PTC Windchill and FlexPLM · added 2026-06-25 · used in ransomware CISA catalog ↗
CVE-2026-12569 EPSS 30.2% 98th percentile exploitation probability
Vendor & gov advisories1
CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue thehackernews.com ↗

Reports CISA KEV addition on 25 June 2026 with 28 June federal deadline; confirms webshell IOC patterns and unauthenticated RCE classification

Analysis & research3
Philips and GE investigating Clop ransomware data theft claims bleepingcomputer.com ↗

Primary reporting with company statements from Philips, GE, and Shell; confirms 43-victim Clop leak-site batch and data categories claimed stolen

PTC Windchill Vulnerability Exploited in Ransomware Campaign securityweek.com ↗

Independent Clop attribution via ReliaQuest and Ransom-ISAC; details the chained exploitation technique and four targeted sectors

JSP webshells being dropped on unpatched PTC Windchill instances helpnetsecurity.com ↗

Defender-actionable IOCs including hex-named webshell paths, flst.txt artefact, and confirmed C2 address 5.180.41.35