Clop's Windchill Web Shell: From Credential Decryption to Design Data Theft Inside the App

1. Basic Information

• Article Title: Clop Returns with Custom Implant in Mass-Extortion Campaign
• Publisher: ReliaQuest Threat Research Team
• Publication Date: 2026-08-18
• Severity: Critical
• Original Source: ReliaQuest
• Related Sources: BleepingComputer, Ransom-ISAC
• Related Malware & Threat Groups: Clop / Cl0p, Windchill-specific JSP Web Shell
• CVE & Products: CVE-2026-12569, PTC Windchill, PTC FlexPLM

2. Summary

This attack involves Clop exploiting a Windchill vulnerability to deploy a custom web shell. The web shell uses the application's own permissions and internal APIs to decrypt credentials in plain text, list design file locations, and steal the data.

3. Attack Flow

Confirmed Core Chain

1. Exploit CVE-2026-12569 on unpatched, internet-facing Windchill or FlexPLM servers.
2. Place a custom JSP web shell inside the Windchill codebase.
3. The attacker sends commands using the HTTP header X-windchill-req.
4. The S command reads configuration files and uses WTKeyStoreUtil.decryptProperty() to decrypt saved secrets, such as LDAP administrator credentials.
5. The L command queries Windchill database tables (ApplicationData, FVITEM, FVMOUNT, MasteredOnReplicaItem, etc.) and writes file IDs, names, paths, and sizes to flst.txt.
6. The G or D command reads the selected files.
7. The server compresses the response with GZIP and returns it to exfiltrate the data.
8. Optionally, the J command receives a Base64-encoded ZIP file to load and execute additional Java bytecode directly inside the Windchill process memory.

Potential Subsequent Compromise

• Facts: The class loader can execute additional Java code in memory.
• Inference: Decrypted LDAP or admin credentials can be used to authenticate to other systems and move laterally.
• Hypothesis: Attackers may deploy ransomware or long-term persistence modules against organizations that refuse to pay.

4. Attacker Position and Execution Location

• The initial attacker is outside, reaching the Windchill HTTP interface.
• The web shell runs inside the Windchill Java application process.
• Database queries use existing Windchill database connection IDs, not a new attacker account.
• Secret decryption uses the Windchill keystore and in-app APIs.
• Additional bytecode also runs inside the memory of the same Java process.

5. Visibility for Victims and Administrators

Users

• The normal Windchill screen may keep running with no obvious visual changes.
• No user action is required.

Administrators and SOCs

• Unfamiliar JSP files and new creation or modification times in the codebase.
• HTTP requests containing X-windchill-req and X-windchill-prm.
• Database queries made by the Windchill service ID that are hard to distinguish from normal operations.
• Creation of flst.txt, followed immediately by file reads and large responses.
• GZIP-compressed responses and continuous outbound data transfers.
• Dynamic Java class loading inside the Windchill process.
• Authentication to other systems using decrypted credentials.

6. Conditions for Success and Failure

Conditions for Success

• Windchill or FlexPLM affected by CVE-2026-12569 is reachable from the outside.
• The vulnerability is unpatched or was not fixed before the breach.
• The attacker can place and execute the JSP file.
• The Windchill service ID can access the database, vault, and keystore normally.
• WAF/Proxy does not block non-standard headers or detect abnormal response contents.

Conditions for Failure

• Vendor patch is applied, and external access is restricted.
• Codebase change monitoring or JSP allowlists block the file when it is placed.
• X-windchill-req is detected and blocked at the perimeter.
• Creation of flst.txt, enumeration of the entire vault, or abnormal file reads are detected.
• If a breach is suspected, all secrets in the keystore are revoked, and existing sessions are ended.

7. What Happens Upon Success

• Secrets for LDAP admins, Windchill admins, and object storage are decrypted to plain text.
• An index of the vault, including product designs and intellectual property, is created.
• Selected files are exfiltrated.
• Additional Java code is executed without saving to disk.
• Inference: Acquired credentials expand the scope of the breach to Active Directory, email, VPN, and databases.

8. Observable Logs

Email

• Email is not needed for the initial intrusion.
• After the breach, extortion emails containing Clop contact info may be sent to employees.

Proxy / SWG / DNS

• Windchill requests containing X-windchill-req and X-windchill-prm.
• Connections from known malicious IPs.
• Continuous downloading of GZIP responses, large file transfers, or numerous file transfers.

Endpoint / EDR

• Unexpected JSP files in the Windchill codebase.
• References to MethodContext, WTConnection, and WTKeyStoreUtil inside the JSP.
• Creation, reading, and deletion of flst.txt.
• Dynamic class loading and Base64/ZIP processing inside the Java process.

Identity / IdP

• Use of LDAP manager or site admin credentials from unusual source IPs or at strange times.
• Existing sessions or tokens remaining valid even after password changes.

SaaS / Cloud

• Use of object storage credentials saved in the keystore.
• Inference: Authentication anomalies on connected SaaS and cloud APIs.

Network

• Increased vault-related queries on normal Windchill-to-database connections.
• Increased access from the Windchill server to internal LDAP, databases, and file storage.
• Subsequent lateral movement and C2 traffic.

9. Attack Success Determination

• Contact Only: Known IPs or abnormal headers are blocked by the WAF; no execution on the server.
• Initial Execution: Confirmed creation of suspicious JSP and invocation in the Windchill process.
• Malware Success: Confirmed valid responses to X-windchill-req (equivalent to the E command response).
• Credential Compromise: Confirmed reading/decryption of the keystore or unauthorized use of saved credentials.
• Data Theft: Confirmed file reading and outbound transfer after flst.txt is generated.
• Follow-on Compromise: Confirmed execution of additional classes, authentication to other hosts, persistence, or encryption.

10. Investigation Playbook

• Trigger: Signs of CVE-2026-12569 exploitation, X-windchill-req, suspicious JSP, flst.txt.
• Initial Verification: Record the product version, exposure range, JSP hash/timestamp/owner, and source IP.
• Endpoints: Preserve the entire codebase diff, Java heap/memory, web access logs, and file timelines.
• Identity & Cloud: Create a list of credentials in the keystore, check usage history, existing tokens, and connected services.
• Subsequent Actions: Search for reuse across LDAP, AD, VPN, email, databases, and storage; check for additional classes and encryption preparation.
• Containment: Isolate Windchill from the outside, remove the JSP after preserving evidence, rotate all secrets, revoke sessions, and apply patches.
• Determination Levels: Exploit Attempt / Web Shell Deployed / Secret Decryption / Vault Mapping / Exfiltration / Follow-on Compromise

11. Defense and Detection Ideas

• Single Event: Combinations of X-windchill-req, suspicious JSP, flst.txt, and specific class names.
• Timeline Correlation: External exploit $\rightarrow$ JSP creation $\rightarrow$ S/L commands $\rightarrow$ flst.txt $\rightarrow$ G/D reads $\rightarrow$ large responses $\rightarrow$ credential reuse.
• Hunting Perspective: Do not ignore activity just because it uses the database connection ID; correlate vault table query volumes with subsequent web responses.
• Log Gaps: Hard to track without custom HTTP headers, TLS decryption, GZIP decompression, Java class-load, and file access audits.
• Priority Actions: Apply patches, restrict public access, monitor codebase changes, and prepare secret rotation procedures in advance.

12. Facts / Inference / Hypothesis

Facts

• A Windchill-specific JSP web shell was used after exploiting CVE-2026-12569.
• Command S decrypts LDAP managers in the keystore, and L outputs the vault index to flst.txt.
• Command J can load and execute Java bytecode from a Base64-encoded ZIP in memory.
• Database queries use existing Windchill connection IDs.
• Communication uses custom headers and GZIP responses.
• ReliaQuest assesses attribution to Clop as "highly likely."

Inference

• A single application breach can spread to the entire enterprise via saved credentials.
• Detecting anomalies only by database accounts is easy to miss; correlation of application, web, database, and identity logs is necessary.

Hypothesis

• Clop may widely scan unpatched environments and reuse the same custom shell.
• The additional class feature may be used to deploy ransomware if extortion fails.

13. MITRE ATT&CK Mapping

• T1190 – Exploit Public-Facing Application (High)
• T1505.003 – Server Software Component: Web Shell (High)
• T1552.001 – Unsecured Credentials: Credentials In Files (High)
• T1140 – Deobfuscate/Decode Files or Information (High - Keystore decryption)
• T1083 – File and Directory Discovery (High)
• T1005 – Data from Local System (High)
• T1027.009 – Embedded Payloads (Medium - Bytecode in Base64 ZIP)
• T1055 – Process Injection (Low - Class loading executes in the same process, differing from typical process injection)
• T1041 – Exfiltration Over C2 Channel (Medium - Outbound transfer is reported, but full communication specs are unpublished)
• T1078 – Valid Accounts (Medium - Subsequent use of decrypted credentials)

14. Unknowns and Further Investigation

• Full exploit request for CVE-2026-12569 and reproducibility per intrusion.
• Full range of web shell file names and installation paths.
• Number of compromised organizations and impact on global industries.
• Data volume in GZIP responses, C2 operation infrastructure, and attack timeframes.
• Confirmed cases of lateral movement or ransomware execution using decrypted credentials.

15. Impact on SOCs and Organizations

Windchill and FlexPLM consolidate design, part, and product information for engineering and manufacturing sectors, making stolen data highly valuable. Incidents should not be treated as simple web server compromises. Organizations must investigate broader impacts—including LDAP and storage credentials stored within the application itself—to address design data theft and enterprise-wide authentication compromise simultaneously.

16. Summary by Target Audience

For SOCs

Correlate events chronologically, starting from X-windchill-req, suspicious JSPs, and flst.txt to vault queries, large responses, and credential reuse. Do not assume activity is safe just because it uses the normal Windchill database ID.

For Administrators

Patch CVE-2026-12569 and limit external exposure of Windchill to the absolute minimum. If a breach is suspected, do not just delete the JSP; revoke all secrets in the keystore and all existing sessions.

For Users

Server-side compromises occur without any user action. If you receive extortion emails or experience unusual Windchill issues, do not reply or attempt to fix it yourself; contact the SOC immediately.