Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Cl0p Hackers Exploit PTC Windchill RCE Flaw to Deploy Custom Data-Theft Web Shell
Threat Actors
Malware Families
Excerpt
The Cl0p ransomware and extortion group is reportedly exploiting CVE-2026-12569, a critical remote code execution flaw in PTC Windchill, to deploy a custom web shell built for large-scale data theft. ReliaQuest Threat Research assessed that the campaign is highly likely linked to Cl0p, also known as Cl0p. The vulnerability has a CVSS score of 9.3 and affects PTC Windchill , a widely used product lifecycle management platform that stores engineering documents, product designs,…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(1)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-12569 | High | Score 71/100 | First seen |
| IP | 5.180.41.35 | Medium | Score 47/100 | First seen |
| SHA256 | 321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf | Medium | Score 55/100 | First seen |
IOC Relationship Graph
Building graph…