How to Detect a Clop Windchill Compromise

How do you tell whether Clop got into your PTC Windchill or FlexPLM server? Look for a small JSP file with a hexadecimal name sitting in the /Windchill/login/ directory. Then look for the web requests that put it there and used it. Search every log you have from early June 2026 onward, because that is when exploitation of CVE-2026-12569 appears to have started.

This page is for the IT managers, security leads and sysadmins who run Windchill or FlexPLM, the product lifecycle management (PLM) software that stores engineering drawings, bills of materials and design data. It covers how Clop's attack works, which indicators to hunt for, how to check whether you are patched, and what to do if you find something.

The common mistake is to treat a patched server as a clean one. The patch closes the hole. It does not delete a webshell, a small script an attacker plants on a web server so they can run commands on it later. It also does not return data that already left. Ransom-ISAC dates suspected zero-day exploitation to early June 2026, before PTC's fix existed. A server patched on the first possible day could still have been compromised before then.

CVE-2026-12569 is a deserialization flaw. Deserialization is the step where a program rebuilds an object from data it has been sent. If the program trusts whatever arrives, an attacker can send data that rebuilds into instructions the server then runs. CISA classifies the bug as improper input validation and deserialization of untrusted data (CWE-20 and CWE-502). CISA also says it lets an unauthenticated remote attacker execute arbitrary code with a crafted network request. "Unauthenticated" means no password is needed. Anyone who can reach the server can try it.

Ransom-ISAC describes the attack as a chain of two bugs:

1. Reconnaissance. A pre-authentication information disclosure in the FlexPLM WSDL endpoint, rated CVSS 7.5. A WSDL is the file a web service publishes to describe itself. Here it leaks information the attacker uses in the next step.
2. Code execution. The attacker then sends the malicious request to the Windchill login servlet, the Java component that handles sign-in. That is CVE-2026-12569 itself.

ReliaQuest researchers, as quoted by Shattered.io, put it simply: attackers "first pull information out of a pre-authentication disclosure bug in the FlexPLM WSDL endpoint, then use it to exploit a separate flaw in the Windchill login servlet."

After the attackers get in, they drop a JSP webshell under /Windchill/login/. It only answers requests that carry a specific custom HTTP header. They use it to list the filesystem, writing the results to a file called flst.txt, and to steal credentials. Then they stage and send out data. SecurityWeek reports ReliaQuest's finding of custom tooling that can "map sensitive vault data, decrypt credentials, and include a Java class loader for executing additional code." The vault is where Windchill stores its files. A class loader lets the attacker load new Java code into the running server without writing another file to disk.

The last step is extortion. According to BleepingComputer, the demands are sent from the victim's own compromised email accounts to many employees at once. Ransom-ISAC says hundreds of employees per organization received them. None of the sources describe files being encrypted. This campaign is about theft and extortion.

The dates that set your search window

The sources give slightly different dates in places. The table uses the most authoritative source for each.

One small conflict: Shattered.io dates the KEV addition to June 26. CISA's own alert is dated June 25, so use that.

How researchers find the webshell

There are three ways to find the webshell. They catch different things, so run all three.

The sources give indicators, not a timed procedure. So the costs below are mainly analyst time and log storage, not licenses. Every tool mentioned (grep, find, a YARA scanner, your SIEM or firewall console) is likely already on the network. Gather these before you start:

1. Map your exposure. List every Windchill and FlexPLM server and check whether each one is reachable from the internet. CISA's KEV entry tells federal agencies to assess each asset's internet exposure, and the same logic applies to everyone. An internet-facing server comes first. It worked when you have a list with a yes or no for internet exposure against each host.

2. Check the patch against PTC's advisory, and write down the date. CISA's KEV entry points to PTC support article CS473270 for remediation. None of the sources here list the fixed build numbers, so compare each server's version with that article, not with a blog post. Record the date each fix was applied. That date matters. Everything before it is time the server was exposed. It worked when each host shows a version, a patched yes or no, and a patch date.

While you are checking versions, look for a second, separate flaw. CISA's ICS advisory ICSA-26-085-03 covers CVE-2026-4681, a CVSS 10 code-injection flaw published March 26, 2026. It affects Windchill PDMLink 11.0 through 13.1.3.0 and FlexPLM 11.0 through 13.0.3.0. It is not the bug Clop used. But a server in that range has another open door.

3. Preserve before you touch anything. Copy the logs and, if you can, take a disk image of each server before deleting files or rebuilding. A webshell deleted before it has been copied cannot be analyzed later. It worked when the evidence is stored somewhere the Windchill server's own credentials cannot reach.

4. Search for the reconnaissance requests. Ransom-ISAC's first-stage indicator is a GET request to /Windchill/rfa/jsp/login/*.jsp?wsdl that returns a response of 4045 bytes. A grep for ?wsdl under that path, filtered on response size, will find it. What you should see on a clean server is nothing, or only requests you can explain.

5. Search for requests to hex-named JSP files. Look for any request to /Windchill/login/ that ends in a JSP file named with hexadecimal characters. The main pattern is [0-9a-f]{16}.jsp, as in the samples 46b158b8607a4c00.jsp and 4b57d0652345d383.jsp. Also check for 6-character variants and names like dpr_ followed by 8 hex characters. Note the source IP of every match.

6. Look for the webshell's password header. The webshells accept commands only when a request carries the header X-windchill-req: ?x8Fmgow. Many web server log formats do not record custom headers. If yours does not, a proxy, load balancer or web application firewall in front of Windchill may have them.

7. Sweep the filesystem. On each server, list every JSP file in the Windchill login directory and compare the list with a clean installation. Search the whole install tree for any file named flst.txt, which the attackers use for filesystem enumeration. It worked when every JSP in that directory is accounted for.

8. Run the structural YARA rule. Ransom-ISAC released JSP_Webshell_Windchill_Structural on August 19. It flags code, not filenames: a password check built on .length()==8 and .substring(1).equals(), reflective class loading through defineClass and getMethod("r"), and input and output handling through getHeader, ZipInputStream and GZIPOutputStream. Scan the whole Windchill tree, not only the login folder. A renamed or relocated shell is exactly what this step exists to catch.

9. Match network indicators. Search firewall and proxy logs from June 1 onward for the published IPs. They include 216.152.148.54, 216.152.151.204, 104.243.35.63, 5.180.41.35 and 79.141.160.78, which Ransom-ISAC marks as priority for blocking, plus 28 more in the advisory. Block them at the edge. Also check file hashes against the published list.

10. Look for data leaving. Shattered.io reports that many victims saw unusual outbound data transfers during July 20 to 26. Compare outbound volume from Windchill servers in that week with a normal week. The stolen data included databases, engineering documents, blueprints, backups and photographs. According to SecurityWeek, the amount per victim ran from about 1 GB to several terabytes, so the transfer may be modest rather than huge.

11. Check mail for extortion messages. Search mail logs for one internal sender writing to an unusual number of colleagues. Clop sends its demands from compromised accounts inside the victim organization, and Ransom-ISAC reports hundreds of recipients per organization. An account that did this has been compromised too and needs its own investigation.

12. If anything matched, treat stored credentials as stolen. The tooling decrypts credentials. Shattered.io says it targets Windchill keystore credentials. Rotate every credential the server stores or uses: service accounts, database passwords and integration keys. Then rebuild the server from a known-good state rather than deleting the shell and carrying on. The class loader means code may have run that left no JSP file behind. It worked when no old credential still works and the rebuilt server passes steps 4 through 9 again.

Stopping at the patch. The pattern this campaign shows is organizations learning about a July breach only when Clop names them. Public naming did not start until August 12. How to recognize it: your ticket for this CVE says "patched" and is closed, but nobody ran steps 4 through 11. What to do: reopen it and hunt from early June.

Starting the search in July. The mass-exploitation week of July 20 to 26 gets most of the coverage, but it is not the start. Ransom-ISAC dates suspected zero-day use to early June, and Help Net Security reports exploitation confirmed by June 18. How to recognize it: your log query starts at July 1, or your retention does not reach back to June. What to do: widen the query. If the logs are gone, say so in your findings. Missing logs mean you cannot rule out a breach.

Hunting only for the 16-character filename. Ransom-ISAC documents three naming conventions, and a filename is the easiest thing for an attacker to change. How to recognize it: your only check is a regex for 16 hex characters. What to do: add the 6-character and dpr_ patterns, then run the structural YARA rule.

Reading the KEV entry too literally. CISA's catalog entry for CVE-2026-12569 does not flag forensic triage as required. But CISA's alert tells agencies to check for prior compromise while patching. For a bug known to be used in ransomware campaigns, run the check.

Deleting the shell and moving on. The webshell is only the visible part. The class loader can run code that leaves no JSP file, and the credential decryption means the attacker may hold logins that still work. What to do: rotate credentials and rebuild, as in step 12.

Treating the extortion email as ordinary phishing. It comes from a real colleague's account and goes to hundreds of people. A help desk may quarantine it and reset one password. What to do: send any such report to the security team as a possible sign of a Windchill breach, not as spam.

Federal civilian agencies. Under Binding Operational Directive 26-04, the KEV deadline was June 28, 2026, three days after CISA added the CVE. That deadline has passed. If you are an agency and missed it, the directive's fallback applies: where mitigations are unavailable, stop using the product.

Servers that were never internet-facing. The attack works over the network without a password, so exposure is the first thing to settle. An internal-only server is lower priority, not zero. If any other internal system was compromised, it can reach Windchill. None of the sources say whether any victim's server was internal-only, so that remains unknown.

FlexPLM as well as Windchill. Both products are affected by CVE-2026-12569. The reconnaissance step uses a FlexPLM WSDL endpoint. Hunt on both.

Servers in the CVE-2026-4681 version range. If a server runs PDMLink 11.0 through 13.1.3.0 or FlexPLM 11.0 through 13.0.3.0, it also faces the separate March 2026 flaw. Patch for both, and do not assume one fix covers the other.

Defense and aerospace suppliers. Aerospace and defense were among the targeted sectors. For these companies, the drawings in Windchill are often the data their contracts govern. Whatever happens with the CMMC Phase 2 timeline, a confirmed theft of that data is a matter for your contracting officer and counsel. It is not only an internal IT incident.

If Clop has already contacted you. If you received an extortion email, treat the breach as likely and start at step 3. Ransom-ISAC says the method matches Clop's Oracle E-Business Suite campaign from last year, except that the sender addresses were new.

The named victims so far include Shell, GE, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, Toast, Mindray and Largan Precision. They span energy, industrial equipment, medical devices, payments and manufacturing.

The sources give no ransom amounts, response costs or recovery figures. We will not estimate any. Set that missing figure against what the hunt costs: log searches and a YARA scan on hardware you already have. The worth of the hunt is finding out before Clop names you, not after.

On severity, the sources disagree slightly. Ransom-ISAC rates CVE-2026-12569 at CVSS 9.8, and BleepingComputer cites 9.3. Shattered.io reports PTC's own ratings at 9.3 to 10.0. Every figure is in the critical band, and none of them change what you should do.