Clop Ransomware Gang Exploits Critical PTC Windchill & FlexPLM Vulnerability in New Extortion Campaign The Clop ransomware gang (also tracked as Cl0p) is actively exploiting a critical improper input validation vulnerability (CVE-2026-12569, CVSS 9.3) in PTC Windchill and FlexPLM instances exposed to the internet. The flaw, a remote code execution (RCE) vulnerability, allows unauthenticated attackers to deploy JSP webshells, enabling data exfiltration from compromised Product Lifecycle Management (PLM) platforms. Cybersecurity firm ReliaQuest reported the attacks on Thursday, noting that the observed tactics align with Clop’s previous campaigns targeting high-value enterprise applications. While the threat actor remains unconfirmed, victims have begun receiving extortion emails from [email protected], a newly adopted address by the gang, which frequently rotates contact details between campaigns. PTC released security patches for CVE-2026-12569 on June 17, issuing private advisories urging customers to apply fixes and check for indicators of compromise (IOCs). Following reports of "heightened threat activity" on June 26, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to secure affected systems within three days. German authorities, including the Federal Office for Information Security (BSI), took emergency measures, directly contacting PTC customers to expedite patching. Windchill and FlexPLM are widely used PLM platforms in aerospace, defense, automotive, and medtech sectors, with PTC reporting over 30,000 global customers. Clop’s history includes high-profile data theft campaigns targeting Accellion FTA, GoAnywhere MFT, MOVEit Transfer, and most recently, an Oracle EBS zero-day flaw in August 2025, which impacted organizations like Harvard University, The Washington Post, and Korean Air. The gang typically publishes stolen data on its dark web leak site if ransom demands are unmet. The U.S. Department of State has offered a $10 million reward for information linking Clop’s operations to a foreign government.