CLOP DEPLOYS CUSTOM WEB SHELL FOR WINDCHILL THEFT

Security researchers identified the custom web shell specifically designed to exploit PTC Windchill and FlexPLM enterprise platforms. The tool features credential decryption functionality, allowing attackers to extract stored authentication data and gain deeper system access. The shell includes repository enumeration capabilities, enabling the threat actors to identify and catalog valuable files before theft. This reconnaissance feature suggests a targeted approach focused on high-value intellectual property and sensitive data. Clop has historically targeted manufacturing, engineering, and technology sectors where these PTC platforms are prevalent. Windchill, used for product lifecycle management, often contains proprietary designs and technical specifications. Organizations running Windchill and FlexPLM should review access logs for suspicious Java activity, patch PTC software immediately, and monitor for credential compromise indicators.