> TritonInfoSec News
Home / Aug 19, 2026 / Story
0
#2 BleepingComputer general August 18, 2026 at 17:29 UTC

Clop created custom web shell for Windchill data theft attacks

By Lawrence Abrams

AI Summary

A custom Java web shell, likely developed by the Clop ransomware gang, was purpose-built to target PTC Windchill and FlexPLM product lifecycle management servers, with built-in functionality to decrypt stored credentials, enumerate file repositories, and exfiltrate data. This represents a significant escalation in Clop's tooling sophistication, moving beyond generic exploitation to industry-specific implants. Organizations running Windchill or FlexPLM should treat these servers as high-priority targets and audit for indicators of compromise.

Read full article → https://www.bleepingcomputer.com/news/security/clo…

Relevance score: 87.0/100

# More from August 19

  1. 1
    Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps The Hacker News
  2. 3
    Philips and GE investigating Clop ransomware data theft claims BleepingComputer
  3. 4
    More than 200 victims of Medusa ransomware identified over the last year, CISA says The Record
  4. 5
    Critical GitLab Zero-Click Flaw Poses Mitigation Challenges Dark Reading
  5. 6
    Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access The Hacker News
  6. 7
    SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch The Hacker News
  7. 8
    TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks The Hacker News
  8. 9
    CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE The Hacker News
  9. 10
    Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware The Hacker News