Cl0p claims attacks on 40+ organisations via PTC Windchill flaw

The Cl0p ransomware group has claimed attacks on more than 40 organisations through a critical vulnerability in PTC’s Windchill and FlexPLM platforms. The flaw, CVE-2026-12569, carries a CVSS score of 9.3 and allows remote code execution via deserialisation of untrusted data. It affects all CPS versions and Windchill and FlexPLM releases before 11.0 M030.

The vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog in June, and exploitation was reported in late July. Cl0p listed partial victim names before publishing full ones from 12 August.

According to security firm ReliaQuest, the group deployed a custom web shell that can decrypt credentials, map files for exfiltration, and includes a Java class loader for further malicious activity.

Victims include Shell, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, Toast, Mindray and Largan Precision. The group claims to have taken databases, project files, backups, engineering documents, blueprints, diagrams and logs, ranging from one gigabyte to several terabytes per organisation.

Many of those targeted are thought to have refused to pay, with much of the material of limited value to anyone buying it. GE was listed initially and has since been removed, which can indicate either a payment or a negotiation in progress.

The campaign follows Cl0p’s established pattern of mass exploitation and extortion, previously seen against MOVEit, Cleo and GoAnywhere.