Clop-linked web shell hits Windchill in new exploit

ReliaQuest has identified a custom web shell it says is highly likely linked to the Clop extortion group and used in attacks on PTC Windchill, tying a new implant to exploitation of CVE-2026-12569.

The malware appears designed specifically for Windchill, a product lifecycle management platform widely used by manufacturers to store engineering data and product designs. It gives attackers a direct way to steal credentials and exfiltrate data without deploying separate malware or issuing obvious operating system commands.

The web shell includes functions for harvesting credentials, reading files, transferring data and mapping file repositories inside the application. It also contains a custom Java class loader that can run additional code in memory from within the application process.

That design allows an intruder to move beyond data theft after the initial breach. The same mechanism could also support lateral movement, long-term persistence or ransomware deployment while leaving fewer artefacts on disk for defenders to find.

Credential risk

A central concern is the tool's ability to expose Windchill credentials in plaintext. A built-in function can read a configuration file, decrypt the LDAP manager password from the application keystore and then decrypt other stored values, including administrative account credentials, object storage credentials and site administrator keys.

As a result, a breach of one internet-facing application server could open access to systems beyond the compromised host. LDAP credentials are often tied to Active Directory, email, VPN and other core services, turning a software exploit into a wider identity compromise across an enterprise environment.

Rather than relying on generic shells commonly reused across campaigns, the implant appears to reflect detailed knowledge of Windchill's internal classes, database schema, keystore and file-vault structure.

The malware also includes a vault enumeration feature built for Windchill's database structure. It can query for vault stream IDs, filenames, storage paths and file sizes, then write the results to a file called flst.txt to create a list of files for exfiltration.

Blending in

The activity is harder to spot because the malware uses the application's own database connections and internal Java classes. As a result, queries may appear to come from Windchill's normal service identity rather than from a separate attacker account or other unusual source.

The shell also routes commands through a custom HTTP header, X-windchill-req, instead of a visible request body, and uses GZIP compression for returned data. That can reduce the effectiveness of security tools that do not inspect headers, decompress responses or inspect encrypted traffic.

ReliaQuest linked the activity to Clop through several indicators, including extortion emails that match contact addresses on the group's leak site, use of the same X-windchill-req header previously associated with Clop in outside reporting, and a pattern of mass exploitation followed by deployment of a tailored web shell.

Clop has a history of exploiting flaws in software that holds valuable business data. The group has previously been associated with custom web shells used after attacks on other enterprise applications, including campaigns tied to the DEWMODE and LEMURLOOT malware families.

Response steps

ReliaQuest urged organisations running Windchill to apply the vendor patch for CVE-2026-12569 and review the internet exposure of Windchill systems. It also recommended hunting for suspicious JavaServer Pages files in Windchill codebase directories, particularly files with recent modification dates or references to the X-windchill-req header and internal classes such as MethodContext, WTConnection and WTKeyStoreUtil.

Organisations that suspect compromise should rotate all credentials stored in the Windchill keystore, starting with LDAP manager and administrative credentials and then moving to any downstream systems where those credentials are reused. Password resets alone may not be enough if active sessions remain valid.

Indicators listed in the analysis include a hash for the alleged web shell and several IP addresses associated with exploitation activity. The report said the malware's structure gives attackers the means to steal sensitive engineering data quickly while keeping much of the activity inside the application's normal trust boundary.

"This campaign is another reminder that Clop remains a sleeping dragon, always looking and preparing to mass exploit vulnerabilities in software that holds sensitive data," ReliaQuest said.