Clop Ransomware Exploits Windchill Vulnerability to Decrypt Credentials and Exfiltrate Engineering Data

A custom JSP web shell linked to the Clop ransomware group exploits a critical vulnerability in PTC Windchill to decrypt credentials and map engineering data for exfiltration. The implant leverages application-specific knowledge to bypass defenses and enable post-exploitation activities without additional tools.

A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management (PLM) software, according to new findings from ReliaQuest.

The cybersecurity company characterized the web shell as a fully equipped extortion platform capable of mapping sensitive vault

Read original article