Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

ReliaQuest has uncovered a sophisticated JavaServer Pages (JSP) web shell deployed by the Clop ransomware group following the exploitation of CVE-2026-12569, a critical improper input validation flaw in PTC Windchill and FlexPLM servers. Unlike generic web shells, this bespoke implant is purpose-built for enterprise Product Lifecycle Management (PLM) software, enabling attackers to decrypt credentials, map sensitive vault data, and execute arbitrary code via a custom Java class loader.

The web shell, attributed to Clop by Ransom-ISAC, eCrime.ch, and Defused, embeds detailed knowledge of Windchill’s APIs, database schema, keystore, and file-vault structure. A single command can extract plaintext administrative credentials by reading configuration files and decrypting LDAP manager passwords, potentially turning a single application compromise into enterprise-wide credential theft. The implant also enumerates high-value engineering data using the application’s own database connections, blending in with normal traffic to evade detection.

This campaign reflects Clop’s evolving tactics, moving from lightweight shells like Behinder or China Chopper to application-specific implants. The group previously deployed DEWMODE and LEMURLOOT after exploiting flaws in Accellion (CVE-2021-27101) and MOVEit Transfer (CVE-2023-34362). ReliaQuest warns that Clop remains a persistent threat, capable of mass exploitation whenever vulnerable software holding sensitive data emerges.