Between August 18–20, 2026, security researchers linked a custom Java web shell to the Clop ransomware gang, designed specifically to exploit PTC Windchill and FlexPLM enterprise software servers. The tool included features to decrypt stored credentials and facilitate data theft.
No BS check run yet — press ⚖ to extract this story's claims and verify them against independent sources.
A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. [...]
Clop created custom web shell for Windchill data theft attacks https://www. bleepingcomputer.com/news/secu rity/clop-created-custom-web-shell-for-windchill-data-theft-attacks/