Cl0p affiliates are exploiting internet-exposed PTC Windchill and FlexPLM product lifecycle platforms through an unauthenticated remote code execution flaw, in a data theft extortion campaign. Product lifecycle management systems track a product from design to retirement and hold computer-aided design files, bills of materials, engineering data, and workflows, making them a concentrated store of intellectual property for manufacturers in automotive, aerospace, defense, medical, and electronics. Cl0p's established pattern is mass exploitation of one enterprise product followed by extortion over stolen data rather than encryption. PTC patched a critical deserialization flaw in the Windchill data management component earlier this year that has already seen exploitation.
The UK Information Commissioner fined South Staffordshire Water 963,900 pounds over a 2022 Cl0p ransomware breach that exposed 633,887 customer and employee records. The penalty notice reveals attackers were inside the network nearly two years before discovery - initial access happened September 2020 via a malicious email attachment, but they were not detected until July 2022 when IT performance issues triggered an investigation. The ICO found basic security failures: an unpatched ZeroLogon flaw on two domain controllers, no principle of least privilege, an outsourced SOC monitoring just 5 percent of the IT estate, and Windows Server 2003 boxes still running in production.
TrustStrike Labs