Cybersecurity firm **ReliaQuest** has unearthed a custom Java web shell believed to be deployed by the **Clop** ransomware gang. This implant is not a generic tool but rather a purpose-built weapon tailored for **PTC Windchill** and **FlexPLM** servers, equipped with features to decrypt credentials, map file repositories, and steal files. **ReliaQuest** analyzed the web shell after its suspected deployment in recent data theft attacks. These attacks exploited **CVE-2026-12569**, a critical remote code execution vulnerability impacting **PTC Windchill**. ### A Highly Specialized Attack Tool According to **ReliaQuest**, the implant showcases detailed knowledge of Windchill's internal APIs, database schema, keystore, and file-vault structure. This indicates a significant investment in understanding the target environment, moving beyond typical web shell capabilities. "This appears to be an application-specific evolution of Clop's established mass-exploitation playbook," **ReliaQuest** stated in a report. The researchers discovered the web shell during their intelligence collection process. The attribution to **Clop** is based on several factors, including extortion emails containing addresses previously used on the gang's data leak site, the presence of `X-windchill-req` headers also found in the web shell, and common tactics, techniques, and procedures (TTPs) associated with the threat actors. ### Clop's History of Mass Exploitation The **Clop** extortion gang has a well-documented history of breaching enterprise platforms for data theft. Previous campaigns have targeted **Accellion FTA**, **GoAnywhere MFT**, **SolarWinds Serv-U FTP**, **Cleo**, and **MOVEit Transfer** file-sharing servers, with the **MOVEit** breach alone affecting over 2,770 organizations worldwide.  In July, it was reported that **Clop** had specifically targeted exposed **PTC Windchill** and **FlexPLM** servers in a data theft and extortion campaign, leveraging **CVE-2026-12569** and deploying JSP web shells. While initial attribution was unconfirmed, **Ransom-ISAC** later corroborated **Clop's** involvement, noting extortion emails sent to hundreds of employees at affected organizations. **PTC** began releasing fixes for **CVE-2026-12569** on June 17, and **CISA** subsequently added the vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate patching due to heightened threat activity. ### Deep Dive into the Windchill Web Shell Analysis by **ReliaQuest** confirms the web shell's specialized nature. It is a JavaServer Pages (JSP) web shell that directly imports Windchill-specific classes such as `MethodContext`, `WTConnection`, and `WTKeyStoreUtil`. These classes allow the shell to leverage Windchill's own functions to access its database, decrypt stored credentials, and locate files within application vaults. "The web shell connects to Windchill's database through the application's own `MethodContext` and `WTConnection` classes, meaning its queries run under the application's existing database identity rather than through a separately configured attacker account," **ReliaQuest** elaborated. "As a result, database telemetry may attribute this activity to the application's normal service identity, limiting the value of alerts that rely solely on detecting new accounts or unexpected source hosts." The web shell operates via a custom protocol embedded within the `HTTP X-windchill-req` header. This header contains an eight-character string, with the first character dictating the command and the remaining seven serving as a fixed validation value.  The web shell supports a range of malicious commands: * **S – Steal Windchill secrets and configuration:** Reads Windchill's LDAP configuration and uses `WTKeyStoreUtil.decryptProperty()` to decrypt the LDAP manager password and other encrypted application data. * **L – Map Windchill's file vault:** Queries Windchill's database for filenames, storage paths, and file sizes, writing results to `flst.txt` for retrieval via the `G` command. * **D – Enumerate directories and retrieve files:** Scans specified paths and reads file portions. * **G – Read a file:** Retrieves the full contents of a specified file. * **R – Delete a file:** Removes a specified file. * **J – Load and execute additional Java code:** Accepts a Base64-encoded ZIP archive containing compiled Java bytecode, loading and executing it directly within the Windchill process. * **O – Identify the operating system:** Returns the operating system name. * **E – Echo supplied data:** Echoes data from the `X-windchill-prm` header to confirm web shell responsiveness. **ReliaQuest** highlights that the web shell's vault enumeration specifically targets tables like `ApplicationData`, `FVITEM`, `FVMOUNT`, and `MasteredOnReplicaItem` within Windchill's database. ### Recommendations for Defense Organizations are strongly advised to immediately patch vulnerable **Windchill** systems. Furthermore, security teams should actively search for unusual JSP files within **Windchill** directories, particularly those referencing `X-windchill-req`. In cases of suspected compromise, it is critical to change the LDAP manager password and all other **Windchill** credentials, assuming they have been compromised.