This week, at industrial companies across half the world, hundreds of people received the same email: "we have your data". No locked screens, no files with strange extensions, no ransom note on the desktop. Cl0p is back and didn't even bother encrypting anything: it walked in through the system that manages product designs —PTC Windchill and FlexPLM—, took what was there and went straight to the register.
If your ransomware plan starts and ends with "we have backups", this incident should interest you in particular. Because here, backups are beside the point.
What happened, facts first
Cl0p affiliates are exploiting CVE-2026-12569, a critical vulnerability (CVSS 9.3) in the PTC Windchill login servlet that allows unauthenticated remote code execution, chained with a pre-authentication information disclosure in the FlexPLM WSDL endpoint (CVSS 7.5). With that, they plant hex-named JSP web shells under /Windchill/login/, enumerate the filesystem and exfiltrate engineering and product data. Then come the extortion emails, sent from previously compromised accounts, to hundreds of users at each company, with the group's contact details.
The victims are the companies that use these platforms: manufacturing, automotive, aerospace, defense, heavy machinery, retail and medtech. It's not a small niche: PTC reports more than 30,000 customers worldwide, and more than 1,500 retail brands use FlexPLM. The active exploitation was detected by ReliaQuest, which published it on Thursday, July 23; Ransom-ISAC confirmed it right away. In Germany, the BSI went as far as calling PTC customers in the middle of the night to warn them.
The timeline matters: PTC started shipping patches on June 17. CISA added the vulnerability to its KEV catalog of exploited vulnerabilities on June 25 and gave US federal agencies 3 days to fix it. On June 26, PTC warned of "heightened threat activity". The wave of extortion emails arrived a month later.
The ransomware that doesn't encrypt (and why your backups won't save you from it)
In the collective imagination, "ransomware" means encrypted files and a countdown on the screen. Cl0p abandoned that model years ago. Its specialty is different: find a vulnerability in internet-exposed enterprise software, exploit it at scale against everyone who has it published, take the data and extort victims by threatening to publish it on its leak site. Without encrypting anything. The track record is a list of products you may recognize: Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U, MOVEit Transfer, Cleo, Oracle E-Business Suite in 2025 —with claimed victims like Harvard, The Washington Post, Logitech and Korean Air— and now Windchill and FlexPLM.
MOVEit put that model's scale into numbers in 2023: according to the tally by Emsisoft and KonBriefing, the campaign ended up affecting more than 2,700 organizations and the data of more than 93 million people. A single vulnerability, in a single product, which many victims didn't even remember they had published. The US State Department offers $10 million for information linking Cl0p to a foreign government; the group, meanwhile, keeps applying the same recipe.
And here is the point we think matters: backups don't undo a theft. A backup gives you your service back when someone encrypts or wipes you; against that, the answer is well-designed immutable backups, and we stand by that. But when what happens is that your designs, your contracts or your customers' data are already on someone else's server, restoring fixes nothing: confidentiality cannot be restored. Half of the modern ransomware problem isn't solved with recovery; it's solved by not leaving the door open.
The app nobody watches
Look at what Cl0p attacks. It's never the employee's laptop, or email, or the firewall. It's always the niche business application: the file transfer manager, the ERP, and now the PLM where your product designs live. Applications that were installed years ago, published to the Internet "because the vendor required it" or because a partner needed access, and that have belonged to no one ever since: the vendor considers them yours, your IT team considers them the vendor's, and the monthly patching plan doesn't include them because "the outside company handles that once a year".
The result is that your real perimeter is not your firewall: it's the login servlet of an application you bought in 2018. It's the same disease we described a few days ago with management consoles exposed to the Internet: things end up published out of convenience, the temporary exception becomes permanent, and nobody looks at it again until an attacker does. The difference is that here the prize isn't control of your network: it's your data, directly.
And you don't need to be Airbus to be on the list. The campaign doesn't pick victims by size or sector: it scans the Internet for published instances and exploits every one it finds. Being small doesn't take you off the list; it takes away the response team the big players have.
What we would do this week
- 1.If you run Windchill or FlexPLM: assume compromise, don't just patch. Apply the patch, hunt for recent JSP web shells under
/Windchill/login/, review connections to the published indicator IPs and rotate the application's credentials. A patch doesn't evict someone who's already inside. - 2.Take inventory of your real exposure. Scan your own public ranges and compare the result with what you believe you have published. In our experience doing consulting, the real list and the mental list almost never match — and the gap between the two is exactly where this campaign lives.
- 3.Take off the Internet what doesn't need to be there. A PLM, an ERP or a document manager used only by employees and known suppliers doesn't need a login open to the world: put it behind a VPN or Zero Trust access. Every application you remove from the shop window is one of these campaigns that no longer applies to you.
- 4.Use the KEV catalog as your cut-off list. CISA gave its agencies 3 days to patch this, and not on a whim. If anything in your exposed inventory shows up in KEV, it gets patched in days, not in whatever quarter comes next. And "the vendor's" applications go into the same cycle as everything else.
- 5.Watch your application servers, not just endpoints. A new web shell in your PLM's web directory is perfectly detectable… if there's an EDR with someone watching on those servers too. And decide before the extortion email arrives who responds, who calls legal and how notification is assessed: if personal data is involved, the GDPR 72-hour clock starts the moment you know.
What we would NOT do
- ✗Bet everything on recovery. Immutable backups, yes, always. But an anti-ransomware plan that only contemplates "restore" is designed for the 2019 attack, not the 2026 one.
- ✗Console ourselves with "we're not a target". In a mass exploitation campaign there is no "target": there is "exposed" and "not exposed". The question isn't whether they'll come looking for you; it's whether your server answers when they scan.
- ✗Buy another box in the heat of the moment. This campaign isn't stopped by a product you don't own: it's stopped by an honest inventory, a patching cycle that includes the awkward applications, and someone watching the servers. It's less shiny than a new appliance, and it works better.
In short
Cl0p has been making money with the same play for five years: the exposed business application nobody considers "security". This time it was the PLM; next time it will be another product with another name, and the script will be identical. The defense doesn't change either: know what you have published, remove what shouldn't be there, patch at KEV speed and watch what remains. None of that comes in a box — and all of it can start this week.
Sources (verified): Cl0p campaign against Windchill/FlexPLM, exploitation chain, web shells, extortion emails, sectors and timeline — BleepingComputer (Jul 24, 2026) and The Hacker News (Jul 25, 2026); CISA KEV catalog entry — The Hacker News (Jun 2026); the 3-day deadline for federal agencies, per BleepingComputer; MOVEit figures (2,700+ organizations, 93+ million people, Emsisoft/KonBriefing tally) — Cybersecurity Dive.
Do you know what you have exposed to the Internet right now?
Almost nobody knows for sure — and that uncertainty is exactly what campaigns like this exploit. At everyWAN we do vendor-agnostic consulting: we audit what you have published, what shouldn't be there and how to close what remains, without selling you licenses for anything. If you'd rather have someone watching it too, our cybersecurity team is on the other side.
Talk to everyWAN
Microsoft 365
ES 
CAT 
EN