Cl0p affiliates are exploiting internet-exposed PTC Windchill and FlexPLM product lifecycle platforms through an unauthenticated remote code execution flaw, in a data theft extortion campaign. Product lifecycle management systems track a product from design to retirement and hold computer-aided design files, bills of materials, engineering data, and workflows, making them a concentrated store of intellectual property for manufacturers in automotive, aerospace, defense, medical, and electronics. Cl0p's established pattern is mass exploitation of one enterprise product followed by extortion over stolen data rather than encryption. PTC patched a critical deserialization flaw in the Windchill data management component earlier this year that has already seen exploitation.
Attackers are actively exploiting a critical flaw in PTC Windchill and FlexPLM, product lifecycle management software widely used across automotive, aerospace, defense, and manufacturing to store designs, engineering data, and intellectual property. The bug (CVE-2026-12569) is an unsafe deserialization issue that lets an unauthenticated attacker run code remotely by sending a crafted request. PTC patched it in mid-June, but has since reported heightened activity, with attackers deploying JSP web shells for command execution and data theft. CISA added it to its Known Exploited Vulnerabilities catalog, the first-ever PTC product to be listed, with a federal deadline of June 28. PTC has published indicators of compromise.
TrustStrike Labs