Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

A JSP web shell linked to the Clop threat actor has been discovered targeting PTC Windchill and FlexPLM servers following exploitation of a critical vulnerability, designed to decrypt credentials and exfiltrate engineering data from enterprise PLM environments. ReliaQuest researchers identified the malware as a sophisticated extortion platform with capabilities to map sensitive vault contents, indicating attackers are leveraging compromised PLM systems for targeted data theft operations.