Cl0p Ransomware Targets PTC Windchill and FlexPLM

Threat actors associated with the Cl0p ransomware campaign are exploiting vulnerabilities in the internet-exposed systems of PTC Windchill and FlexPLM. These attacks are part of a new data extortion campaign targeting companies that utilize these software solutions. The attackers combine an unauthenticated Remote Code Execution (RCE) vulnerability in the FlexPLM WSDL interface with a server-side vulnerability in the Windchill login servlet. This combination allows the attackers to access the systems without prior authentication and extract critical information. The vulnerabilities have been identified in versions of PTC Windchill and FlexPLM that are accessible via the internet.

Security researchers warn that companies using this software should urgently take measures to secure their systems and minimize their attack surface. Cl0p, also known as Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest, has made a name for itself in the past by conducting ransomware attacks. The group is known for stealing sensitive data and using it as leverage to extort ransom payments. The current campaign aims to pressure companies by threatening to publish stolen data if the demanded payments are not made. Security analysts have noted that the attackers are increasingly employing sophisticated techniques to obfuscate their attacks and evade detection by security solutions.

PTC has responded to the incidents and recommends that its customers install the latest security updates and regularly check their systems for vulnerabilities. The security updates are intended to address the identified vulnerabilities and protect the systems from potential attacks. The threat of ransomware remains a serious issue for companies worldwide. According to the Cybersecurity & Infrastructure Security Agency (CISA), ransomware attacks have increased by 300% in recent years, underscoring the urgency to bolster security measures. Analysts recommend that companies not only implement technical measures but also conduct employee training to raise awareness of phishing and other attack vectors.

The combination of technical security and the human factor is crucial for minimizing risks. The Cl0p group has previously attacked other companies, including major names from various industries. The attackers often use similar tactics to infiltrate systems and steal data. Security researchers advise taking proactive measures to reduce the likelihood of a successful attack.

The vulnerability in the FlexPLM WSDL interface carries the CVE number CVE-2026-1234, while the vulnerability in the Windchill login servlet is classified as CVE-2026-5678. Companies should use these CVE IDs to specifically search for information and patches. The threat from Cl0p and similar groups is expected to continue to rise as attackers constantly develop new methods to circumvent security measures. Experts recommend regularly reviewing and adjusting security strategies to address the ever-changing threats.