A custom JavaServer Pages (JSP) web shell linked to the Clop ransomware gang and built specifically to target the Clop Windchill web shell attack surface has been analysed by cybersecurity company ReliaQuest, revealing a tool so tightly integrated with PTC Windchill’s internals that its malicious database queries can masquerade as normal application activity. The implant exploits CVE-2026-12569, a critical remote code execution vulnerability carrying a CVSS score of 9.8 according to Penligent, and has been deployed in active data theft campaigns against Windchill and FlexPLM servers.
ReliaQuest shared its findings with BleepingComputer, describing the web shell as ‘an application-specific evolution of Clop’s established mass-exploitation playbook.’ The researchers say it is not a generic implant repurposed for the job. Instead, it was built with detailed knowledge of Windchill’s internal APIs, database schema, keystore, and file-vault structure, a level of familiarity that points to deliberate, targeted development rather than opportunistic re-use.
How the Clop Windchill Web Shell Operates
Attribution to Clop rests on several converging indicators: extortion emails containing addresses used on the gang’s data leak site, previously observed X-windchill-req HTTP headers that also appear in the web shell’s control protocol, and tactics, techniques, and procedures consistent with Clop’s prior campaigns. Ransom-ISAC separately confirmed Clop activity associated with these attacks, including extortion emails sent to hundreds of employees at affected organisations.
The web shell imports Windchill-specific classes directly (MethodContext, WTConnection, and WTKeyStoreUtil) allowing it to operate through the application’s own database identity rather than through a separately configured attacker account. ReliaQuest flags this as a detection problem: ‘database telemetry may attribute this activity to the application’s normal service identity, limiting the value of alerts that rely solely on detecting new accounts or unexpected source hosts.’
Commands are delivered via the HTTP X-windchill-req header. The first character specifies the operation; the remaining seven match a fixed validation value. The supported commands cover a precise theft pipeline: S reads LDAP configuration and uses WTKeyStoreUtil.decryptProperty() to decrypt the LDAP manager password and other encrypted data; L maps Windchill’s file vault by querying the database for filenames, storage paths, and file sizes, writing results to a file named flst.txt; D enumerates directories and reads file portions; G retrieves a specified file; R deletes a file; J loads and executes additional Java bytecode passed as a Base64-encoded ZIP archive directly into memory; O identifies the operating system; and E echoes data to verify the shell is live.
The vault enumeration queries four specific database tables: ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem. That specificity is another sign the tool was written by someone who knew exactly what they were looking for inside a Windchill deployment.
Patch Status, CISA’s Deadline, and Remediation Advice
Clop’s history of targeting enterprise file-sharing platforms is long. Previous campaigns hit Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer, the MOVEit campaign alone affecting more than 2,770 organisations worldwide. Windchill represents the latest in that series.
PTC began releasing fixes for CVE-2026-12569 on 17 June. Patches are now available across a broad range of versions: SUPs 13.1.3 and 13.1.2, and CPSXB stand-alone patches for versions 13.1.1, 13.0.2, 12.1.2, 12.0.2, 11.2.1, 11.1 M020, and 11.0 M030, according to PTC‘s advisory centre. CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities catalogue following warnings of heightened threat activity, and per Hard2Bit, ordered federal agencies to remediate by 28 June.
ReliaQuest recommends organisations immediately patch vulnerable Windchill systems and hunt for unusual JSP files in Windchill directories, particularly any referencing the X-windchill-req header. Any organisation that suspects compromise should treat the LDAP manager password and all other Windchill credentials as already stolen and rotate them immediately, because if the web shell’s S command ran, the decryption work is already done and the credentials are in Clop’s hands.
