The cybersecurity company ReliaQuest analyzed a Java-based Web Shell, likely developed by the Clop gang specifically for PTC Windchill and FlexPLM servers to conduct data theft operations. The tool was discovered during intelligence gathering related to attacks exploiting the critical vulnerability CVE-2026-12569, a remote command execution vulnerability in Windchill.
ReliaQuest believes the tool is not a repurposed general-purpose Web Shell, but was built with detailed knowledge of Windchill’s internal interfaces, database schema, key store, and the structure of the file vaults on which the application relies. The company describes this development as a custom extension of Clop’s known approach of exploiting enterprise platforms, stealing data, and then extorting affected organizations.
Indicators Linking the Tool to the Clop Gang
Researchers link the activity to the gang based on several indicators, including extortion emails containing addresses used on Clop’s data-leak site, the presence of X-windchill-req headers previously observed in the tool, and operational methods and techniques commonly used by the attackers. Ransom-ISAC later confirmed Clop activity associated with these attacks, including the sending of extortion emails to hundreds of employees at affected organizations.
The campaign comes amid the gang’s long history of targeting file-transfer and file-management platforms, such as Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer. The previous MOVEit campaign affected more than 2,770 organizations worldwide.
Capabilities Embedded Inside Windchill
The tool imports classes specific to Windchill, including MethodContext, WTConnection, and WTKeyStoreUtil. These classes allow it to use the application’s own functions to access the database, decrypt stored credentials, and identify files located in the application’s vaults.
The tool connects to the Windchill database using the existing application service identity instead of creating a separate database account for the attacker. As a result, some queries may appear in database logs as though they originated from the usual service identity, reducing the effectiveness of alerts that rely solely on detecting new accounts or unfamiliar connection sources.
Control commands are sent through an HTTP header named X-windchill-req, consisting of eight characters; the first character specifies the command, while the remaining seven characters match a fixed value. The discovered functions include:
- S: Steal Windchill secrets and settings, including LDAP configuration, decrypt the LDAP administrator password, and obtain other encrypted application data.
- L: Inventory file vaults, extracting file names, storage paths, and sizes, and saving the results in a file named flst.txt.
- D and G: Browse specified paths and read parts of files or retrieve the contents of a specific file.
- R: Delete a file.
- J: Upload a Base64-encrypted ZIP archive and execute additional Java code inside the Windchill process.
- O and E: Identify the operating system and verify the Web Shell’s response by echoing the submitted data.
What Changes in Practice for Operators?
ReliaQuest recommends installing available Windchill updates immediately and searching for unusual JSP files inside Windchill directories, particularly files that reference X-windchill-req. Organizations that suspect their servers have been compromised should also change the LDAP administrator password and other Windchill credentials, considering them potentially compromised.
PTC began releasing fixes for the CVE-2026-12569 vulnerability on June 17, after which CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog following warnings of escalating activity associated with it. This indicates that protecting the server involves more than applying the patch; it also includes reviewing files, logs, and sensitive data that the tool may have accessed.