Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Cl0p Exploits PTC Windchill Zero-Day to Deploy Webshells and Steal Data
Threat Actors
Malware Families
Excerpt
Cl0p ransomware affiliates are actively exploiting a critical zero-day in PTC Windchill and FlexPLM (CVE-2026-12569) to gain unauthenticated remote code execution, drop JSP webshells, and exfiltrate sensitive engineering data for double‑extortion. Documented by ISAC, the campaign targets internet‑exposed PLM environments across manufacturing, automotive, aerospace, and retail/apparel sectors, leveraging a chained exploit path that begins with a FlexPLM WSDL information…
Read the original report →Diamond Model
Adversary(2)
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-12569 | High | Score 71/100 | First seen |
| SHA256 | 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…