Clop Created Custom Web Shell for Windchill Data Theft Attacks

A custom Java web shell linked to the Clop ransomware gang was built specifically to steal data from PTC Windchill and FlexPLM servers.

Researchers say the malware can decrypt application credentials, search file repositories and retrieve files from compromised servers. Its design suggests that the operators understood Windchill’s internal APIs, database structure and storage system in detail.

Clop Windchill web shell targets vulnerable servers

Cybersecurity firm ReliaQuest analysed the web shell after attackers reportedly used it in data theft attacks targeting CVE-2026-12569.

The critical remote code execution flaw affects PTC Windchill. PTC began releasing fixes on June 17, while CISA later added the vulnerability to its Known Exploited Vulnerabilities catalog.

ReliaQuest believes attackers deployed the malware against exposed Windchill and FlexPLM systems. The activity matches Clop’s established approach of mass-exploiting enterprise software, stealing data and then demanding payment from affected organisations.

Researchers linked the campaign to Clop through extortion emails, infrastructure patterns and a custom HTTP header previously connected to the group’s Windchill attacks.

Malware uses Windchill’s own functions

The implant is a JavaServer Pages, or JSP, web shell. Unlike a generic backdoor, it imports classes that are unique to Windchill, including MethodContext, WTConnection and WTKeyStoreUtil.

Those components allow the malware to connect to Windchill’s database through the application’s existing service identity. As a result, suspicious activity may appear to come from the legitimate Windchill service instead of a separate attacker account.

The web shell can access Windchill configuration data and use the platform’s own decryption function to uncover stored LDAP manager passwords and other encrypted application secrets.

It can also map file vaults by querying Windchill’s database for filenames, file paths and file sizes. Attackers can then retrieve selected files, inspect directories or delete data.

Custom header controls the malicious tool

The Clop Windchill web shell receives commands through a custom HTTP header called X-windchill-req.

The shell uses that header to validate requests and perform actions such as reading files, listing file-vault contents, identifying the operating system and loading additional Java code directly into the Windchill process.

Its ability to load Java bytecode in memory could give attackers a way to extend the compromise without relying on additional files stored on disk.

ReliaQuest also found that the malware queries tables associated with Windchill’s application data and file-vault storage. This further indicates that the tool was developed for this platform rather than adapted from a general-purpose web shell.

Organisations should patch and investigate

Organisations running PTC Windchill should install the available security updates immediately and check whether any systems remain exposed to the internet.

Security teams should investigate unusual JSP files in Windchill directories, particularly files that reference the X-windchill-req header. They should also review web logs for unexpected requests containing that header.

Any organisation that suspects a compromise should treat its Windchill credentials as exposed. Administrators should reset LDAP manager passwords and other application secrets, then review database and file-access activity for signs of data theft.