Clop ransomware hits Windchill via CVE-2026-12569 flaw

THE Clop ransomware gang, also known as Cl0p, is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign. They are exploiting a critical vulnerability, CVE-2026-12569, which allows execution of arbitrary code on the affected systems. According to cybersecurity company ReliaQuest, Clop operators are using JSP webshells to steal sensitive data from compromised Product Lifecycle Management (PLM) platforms.