# Researchers detail Windchill-specific web shell linked to Clop attacks

_Tuesday, August 18, 2026 at 1:29 PM EDT · Security · Latest · Tier 1 — Major_

![Researchers detail Windchill-specific web shell linked to Clop attacks — Primary](https://www.bleepstatic.com/content/hl-images/2022/10/28/hand-sifting-data.jpg)

ReliaQuest analyzed a custom Java web shell likely linked to Clop data-theft attacks against PTC Windchill and FlexPLM servers. The researchers say the tool can use Windchill functions to decrypt credentials, query databases, map file vaults and retrieve files. PTC began releasing fixes for the exploited critical vulnerability on June 17, and CISA later added it to its Known Exploited Vulnerabilities catalog.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/clop-created-custom-web-shell-for-windchill-data-theft-attacks/)

---
Canonical: https://techandbusiness.org/newswire/8QDL6nMHrOvmZBNeSoR3g-
Retrieved: 2026-08-18T21:09:13.845Z
Publisher: Tech & Business (techandbusiness.org)