Executive Summary
The Clop ransomware gang has been identified targeting internet-exposed PTC Windchill and FlexPLM instances in a widespread data theft and extortion campaign. This activity leverages CVE-2026-12569, a critical insecure deserialization vulnerability with a CVSS score of 9.3 to 10.0, allowing unauthenticated remote code execution. Authorities in Germany (BSI) and the United States (CISA) have responded with high urgency, including emergency night-time notifications to affected administrators, due to the high risk of compromise.
Technically, the attackers exploit the improper input validation to deploy JSP webshells, which facilitate remote command execution and mass data exfiltration. Following the theft, Clop has been observed sending extortion emails to hundreds of employees within targeted organizations, often using previously compromised third-party accounts to bypass filters. This campaign mirrors previous large-scale extortion efforts by Clop, such as those targeting MOVEit and Oracle EBS, emphasizing a shift toward high-value enterprise application exploitation rather than traditional encryption-based ransomware.