Clop builds custom web shell to steal Windchill data
▼ Summary
– A custom Java web shell linked to Clop was designed specifically for PTC Windchill and FlexPLM servers, using Windchill’s internal APIs to decrypt credentials and steal files.
– It was deployed in attacks exploiting CVE-2026-12569, a critical remote code execution vulnerability, with attribution to Clop based on extortion emails and shared tactics.
– The web shell connects to Windchill’s database via its own classes, so activity appears as normal application traffic, evading detection based on new accounts or hosts.
– It supports commands like stealing secrets, mapping file vaults, reading/deleting files, and loading Java code, all controlled via the X-windchill-req header.
– ReliaQuest advises patching Windchill systems, checking for unusual JSP files, and rotating LDAP manager and other credentials if compromised.
A newly discovered custom web shell, believed to be the work of the Clop ransomware group, was engineered with one specific purpose: extracting data from PTC Windchill and FlexPLM servers. Unlike generic malware, this tool includes native capabilities to decrypt credentials, map file repositories, and exfiltrate sensitive documents.
Security firm ReliaQuest uncovered the implant during threat intelligence gathering, linking it to recent data theft campaigns that exploited CVE-2026-12569, a critical remote code execution flaw in PTC Windchill. What sets this web shell apart is its deep integration with Windchill’s internal architecture, including its APIs, database schema, keystore, and file vault structure. The attackers clearly possessed detailed knowledge of the platform.
“This appears to be an application-specific evolution of Clop’s established mass-exploitation playbook,” ReliaQuest noted in a report shared with BleepingComputer.
Attribution to Clop is based on several factors: extortion emails using addresses tied to the gang’s data leak site, the presence of X-windchill-req headers previously observed in Clop operations, and tactics, techniques, and procedures consistent with the group’s historical behavior. Clop has a lengthy track record of breaching enterprise platforms, with past campaigns hitting Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer, the latter impacting more than 2,770 organizations globally.
In July, BleepingComputer reported that Clop had launched a data theft extortion campaign against exposed PTC Windchill and FlexPLM servers, leveraging CVE-2026-12569 and deploying JSP web shells. At that time, ReliaQuest considered attribution unconfirmed but noted strong similarities to previous Clop operations. Ransom-ISAC later confirmed the gang’s involvement after extortion emails were sent to hundreds of employees at affected firms, each containing updated contact details for the group.
PTC began issuing patches for CVE-2026-12569 on June 17, and CISA subsequently added the flaw to its Known Exploited Vulnerabilities catalog following warnings of heightened threat activity.
A web shell purpose-built for Windchill
ReliaQuest’s analysis, corroborated by BleepingComputer, confirms the tool is no generic backdoor. It is a JavaServer Pages (JSP) web shell that directly imports Windchill-specific classes, including MethodContext, WTConnection, and WTKeyStoreUtil. These components allow the malware to leverage Windchill’s own functions for database access, credential decryption, and file retrieval from application vaults.
“The web shell connects to Windchill’s database through the application’s own MethodContext and WTConnection classes, meaning its queries run under the application’s existing database identity rather than through a separately configured attacker account,” ReliaQuest explained. “As a result, database telemetry may attribute this activity to the application’s normal service identity, limiting the value of alerts that rely solely on detecting new accounts or unexpected source hosts.”
Command and control occurs via a custom protocol embedded in the HTTP X-windchill-req header. The header contains eight characters: the first specifies the command, while the remaining seven must match a fixed value. The web shell supports a range of commands:
- S: Steals Windchill secrets and configuration. It reads the LDAP configuration and uses WTKeyStoreUtil.decryptProperty() to decrypt the LDAP manager password and other encrypted application data.The vault enumeration routine is equally tailored, targeting specific database tables: ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem.ReliaQuest urges organizations to patch vulnerable Windchill systems immediately and to inspect Windchill directories for suspicious JSP files, particularly those referencing X-windchill-req. Any organization that suspects compromise should also rotate the LDAP manager password and other Windchill credentials, as they may already be in the attackers’ hands.
