Clop’s Custom Web Shell Used in Windchill Data Theft Attacks

A custom Java web shell linked to the Clop ransomware gang has been designed specifically to target PTC Windchill and FlexPLM servers. The malware can decrypt stored credentials, enumerate file repositories, access sensitive files, and execute additional Java code.

Cybersecurity firm ReliaQuest analyzed the Windchill web shell after finding it deployed during recent data theft attacks that exploited CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill.

ReliaQuest said the implant is not a repurposed, generic web shell. Instead, it was developed with detailed knowledge of Windchill’s internal application programming interfaces, database schema, keystore, and file vault structure.

“This appears to be an application-specific evolution of Clop’s established mass exploitation strategy,” ReliaQuest said in a report shared with BleepingComputer.

Researchers discovered the Windchill web shell during an investigation into the threat activity. They believe the campaign is likely connected to Clop based on several indicators, including addresses listed on the ransomware group’s data leak site, the previously observed X-windchill-req HTTP header, and extortion emails containing tactics, techniques, and procedures commonly associated with the threat actor.

The Clop extortion group has a long history of targeting enterprise file-sharing and business applications to steal data. Previous campaigns have affected Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer. The MOVEit campaign impacted more than 2,770 organizations worldwide.

As BleepingComputer reported in July, Clop targeted exposed PTC Windchill and FlexPLM servers in a data exfiltration campaign. Attackers exploited CVE-2026-12569 and deployed a JavaServer Pages (JSP) web shell to maintain access and steal information.

ReliaQuest initially said that the attack could not be conclusively attributed to Clop. However, the campaign shared multiple similarities with the group’s previous data theft operations against secure file-sharing platforms.

Ransom-ISAC later confirmed Clop-related activity, including extortion emails sent to hundreds of employees at affected organizations. The messages included the ransomware group’s latest contact information.

PTC began releasing fixes for CVE-2026-12569 on June 17. CISA later added the vulnerability to its Known Exploited Vulnerabilities Catalog following warnings about increased exploitation activity.

Clop web shell was built specifically for Windchill

ReliaQuest’s analysis, along with BleepingComputer’s review, confirms that the malware was created to target PTC Windchill servers rather than operate as a general-purpose web shell.

The malware is a JSP web shell that directly imports Windchill-specific classes, including MethodContext, WTConnection, and WTKeyStoreUtil.

These classes allow the web shell to use native Windchill functions to connect to databases, decrypt stored credentials, and search for files stored in the application’s vault.

“The web shell connects to Windchill’s database through the application’s own MethodContext and WTConnection classes, meaning its queries run under the application’s existing database identity, rather than through a separately configured attacker account,” ReliaQuest explained.

“As a result, database telemetry may determine that this activity is due to the application’s normal service identity, limiting the value of alerts that rely solely on the detection of new accounts or unexpected source hosts.”

The web shell receives commands through the X-windchill-req HTTP header. The header contains eight characters: the first character identifies the requested command, while the remaining seven characters match a fixed value.

The Windchill web shell supports the following commands:

• S – Steal Windchill secrets and configurations. Reads Windchill’s LDAP configuration and uses WTKeyStoreUtil.decryptProperty() to decrypt LDAP manager passwords and other encrypted application data.
• L – Map Windchill file vaults. Queries Windchill’s database to identify file names, storage paths, and file sizes. The results are written to flst.txt, which can then be accessed using the G command.
• D – Enumerate directories and retrieve files. Lists the contents of a specified directory and reads part of a selected file.
• G – Read a file. Retrieves the contents of a specified file.
• R – Delete a file. Deletes the specified file from the server.
• J – Load and execute additional Java code. Accepts a Base64-encoded ZIP archive, loads the compiled Java bytecode directly into memory, and executes it within the Windchill process.
• O – Identify the operating system. Returns the name of the server’s operating system.
• E – Echo provided data. Echoes supplied data and can use the X-windchill-prm header to verify that the web shell is responding.

According to ReliaQuest, the web shell’s file-vault enumeration function was also specifically developed to query tables in Windchill databases. BleepingComputer’s analysis identified the tables as ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem.

ReliaQuest recommends that organizations immediately patch vulnerable Windchill and FlexPLM systems. Administrators should also search for unusual JSP files in Windchill directories, particularly files containing references to X-windchill-req.

Organizations that suspect their Windchill servers were compromised should investigate for unauthorized access, rotate LDAP manager passwords, and change other Windchill credentials. These credentials should be treated as compromised until the investigation is complete.

The overall prevention score can hide what happens after initial access. If an attacker uses valid credentials, your defenses can drop sharply.

Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report