A custom Java web shell tied to attacks on PTC Windchill and FlexPLM servers was engineered specifically for those platforms, not repurposed from a generic toolkit, according to new analysis from ReliaQuest. The firm believes the implant is linked to the Clop extortion gang and was deployed in recent data theft attacks exploiting CVE-2026-12569, a critical remote code execution vulnerability in PTC Windchill.

ReliaQuest says the web shell reflects detailed knowledge of Windchill’s internal APIs, database schema, keystore, and file-vault structure. It directly imports Windchill-specific Java classes, including MethodContext, WTConnection, and WTKeyStoreUtil, to query the application’s database and decrypt stored credentials using Windchill’s own functions.

Living off the application

Because the shell reuses Windchill’s existing database identity rather than a separate attacker-controlled account, ReliaQuest warns that database telemetry may attribute malicious queries to the application’s normal service account, undermining detections that rely on spotting new accounts or unfamiliar source hosts.

The malware is controlled through a custom protocol carried in the HTTP header X-windchill-req, an eight-character string whose first character specifies a command. Supported commands include stealing LDAP and other decrypted secrets, mapping the file vault by querying tables such as ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem, enumerating directories, retrieving or deleting files, loading and executing additional Java bytecode in memory, identifying the host operating system, and an echo function to verify the shell is responding.

Attribution to Clop

ReliaQuest links the activity to Clop based on extortion emails using addresses seen on the gang’s data leak site, the same X-windchill-req header observed in earlier campaigns, and tactics consistent with Clop’s history. Ransom-ISAC previously confirmed Clop involvement, including extortion emails sent to hundreds of employees at affected organizations. Clop has a long track record of exploiting enterprise file-sharing and PLM platforms for mass data theft, including Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U, Cleo, and MOVEit Transfer, the last of which affected more than 2,770 organizations.

PTC began releasing patches for CVE-2026-12569 on June 17, and CISA has since added the flaw to its Known Exploited Vulnerabilities catalog. ReliaQuest urges organizations to patch immediately, hunt for unusual JSP files in Windchill directories referencing X-windchill-req, and treat LDAP manager passwords and other Windchill credentials as compromised if intrusion is suspected.