Clop custom Java web shell targets PTC Windchill and FlexPLM servers

Wed, 19 Aug 2026 11:36:35 +0000

Engineer — Act: If you run PTC Windchill or FlexPLM, audit those servers for this Java web shell immediately — it is purpose-built to decrypt stored credentials and exfiltrate file repositories. Pull IOCs from the BleepingComputer article and sweep web-accessible directories on those hosts.
SOC/IR — Act: Clop’s use of a bespoke web shell against Windchill/FlexPLM indicates an active, ongoing campaign with credential theft as a precursor step; hunt for anomalous Java process activity and unauthorized file enumeration on any PLM servers in your estate, and ingest the published IOCs into your SIEM.
Leader — Plan: Clop is expanding its toolset to target PLM systems common in manufacturing and engineering sectors — verify whether Windchill or FlexPLM appears in your environment or third-party supply chain, and direct your security team to audit those systems this quarter.

Shell investigates Clop ransomware data theft claim (89GB)

Sat, 15 Aug 2026 11:32:14 +0000

Engineer — Skip
SOC/IR — Learn: Clop continues targeting large enterprises via data theft extortion; no IOCs or TTPs published yet — monitor for technical follow-up reports to inform detection tuning against Clop’s known access patterns.
Leader — Act: If Shell is a vendor or partner, request their incident status and any attestation of scope this week; even without confirmed breach, brief leadership before this surfaces in board or customer questions.