A custom Java web shell, believed to be linked to the Clop ransomware group, has been identified as specifically designed for PTC Windchill and FlexPLM servers. The web shell possesses built-in functionalities to decrypt credentials, enumerate file repositories, and exfiltrate data.
Cybersecurity firm ReliaQuest analyzed the web shell, which is thought to have been deployed in recent data theft attacks exploiting CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill. ReliaQuest asserts that this implant is not a generic web shell but was developed with detailed knowledge of Windchill's internal APIs, database schema, keystore, and file-vault structure. This suggests an application-specific evolution of Clop's typical mass-exploitation tactics.
The connection to Clop is based on several indicators, including extortion emails containing addresses previously used on the group's data leak site, the presence of `X-windchill-req` headers also used by the web shell, and common tactics, techniques, and procedures (TTPs) associated with the threat actors. Ransom-ISAC later confirmed Clop's involvement, noting extortion emails sent to hundreds of employees at affected organizations, which included the gang's latest contact information.
PTC began releasing patches for CVE-2026-12569 on June 17, and the vulnerability was subsequently added to CISA's Known Exploited Vulnerabilities catalog following warnings of increased threat activity.
The malware is a JavaServer Pages (JSP) web shell that directly imports Windchill-specific classes such as `MethodContext`, `WTConnection`, and `WTKeyStoreUtil`. These classes enable the shell to leverage Windchill's own functions to access its database, decrypt stored credentials, and locate files within application vaults. By connecting to Windchill's database through the application's own `MethodContext` and `WTConnection` classes, the web shell's queries run under the application's existing database identity, potentially making it harder to detect through alerts relying on new accounts or unexpected source hosts.
The web shell is controlled via a custom protocol transmitted through the HTTP `X-windchill-req` header. This header contains an eight-character string, with the first character dictating the command and the remaining seven matching a fixed value.
The web shell supports several commands: S: Steals Windchill secrets and configuration by reading LDAP configuration and using `WTKeyStoreUtil.decryptProperty()` to decrypt the LDAP manager password and other encrypted application data. L: Maps Windchill's file vault, searching the database for filenames, storage paths, and file sizes, then writing results to a file named `flst.txt` for retrieval. D: Enumerates specified paths and reads portions of files. G: Retrieves the contents of a specified file. R: Deletes a specified file. J: Loads and executes additional Java code by passing a Base64-encoded ZIP archive, loading compiled Java bytecode directly into memory, and executing it within the Windchill process. O: Identifies the operating system. E: Echoes supplied data from the `X-windchill-prm` header to verify web shell responsiveness.
ReliaQuest's analysis indicates that the web shell's vault enumeration specifically queries certain tables in Windchill's database, including `ApplicationData`, `FVITEM`, `FVMOUNT`, and `MasteredOnReplicaItem`.
Organizations are advised to immediately patch vulnerable Windchill systems and investigate Windchill directories for unusual JSP files, particularly those referencing `X-windchill-req`. If compromise is suspected, the LDAP manager password and other Windchill credentials should be considered compromised and changed.
