Clop's Windchill Web Shell: From Credential Decryption to Design Data Theft Inside the App

Clop's Windchill Web Shell: From Credential Decryption to Design Data Theft Inside the App 1. Basic Information Article Title : Clop Returns with Custom Implant in Mass-Extortion Campaign Publisher : ReliaQuest Threat Research Team Publication Date : 2026-08-18 Severity : Critical Original Source : ReliaQuest Related Sources : BleepingComputer , Ransom-ISAC Related Malware & Threat Groups : Clop / Cl0p, Windchill-specific JSP Web Shell CVE & Products : CVE-2026-12569, PTC Windchill, PTC FlexPLM 2. Summary This attack involves Clop exploiting a Windchill vulnerability to deploy a custom web shell. The web shell uses the application's own permissions and internal APIs to decrypt credentials in plain text, list design file locations, and steal the data. 3. Attack Flow Confirmed Core Chain Exploit CVE-2026-12569 on unpatched, internet-facing Windchill or FlexPLM servers. Place a custom JSP web shell inside the Windchill codebase. The attacker sends commands using the HTTP header X-windchill-req . The S command reads configuration files and uses WTKeyStoreUtil.decryptProperty() to decrypt saved secrets, such as LDAP administrator credentials. The L command queries Windchill database tables ( ApplicationData , FVITEM , FVMOUNT , MasteredOnReplicaItem , etc.) and writes file IDs, names, paths, and sizes to flst.txt . The G or D command reads the selected files. The server compresses the response with GZIP and returns it to exfiltrate the data. Optionally, the J command receives a Base64-encoded ZIP file to load and execute additional Java bytecode directly inside the Windchill process memory. Potential Subsequent Compromise Facts : The class loader can execute additional Java code in memory. Inference : Decrypted LDAP or admin credentials can be used to authenticate to other systems and move laterally. Hypothesis : Attackers may deploy ransomware or long-term persistence modules against organizations that refuse to pay. 4. Attacker Position and Execution Location The initi