Affiliates of the Cl0p ransomware operation, also tracked under names including Graceful Spider, Chubby Scorpius, FIN11, and Lace Tempest, are actively exploiting exposed PTC Windchill and FlexPLM servers to steal engineering and product-design data, according to a report from Ransom-ISAC produced alongside eCrime.ch and DEFUSED. Rather than encrypting systems outright, the campaign leans on a familiar double-extortion playbook: steal first, then pressure victims with the threat of public exposure even when backups make recovery straightforward.

Who Is Most at Risk

Windchill and FlexPLM are product lifecycle management platforms widely used to store design documents, product specifications, and development workflows. That makes manufacturers, automotive companies, aerospace organizations, and retail apparel firms particularly exposed, since a successful breach can leak intellectual property that took years to develop and is effectively impossible to replace once it reaches a criminal marketplace or a competitor.

The Technical Chain: No Credentials Required

According to Ransom-ISAC, the intrusions trace back to early June and follow a two-stage exploitation chain. Attackers first abuse a pre-authentication information disclosure issue in the FlexPLM WSDL endpoint, then chain it with a weakness in the Windchill login servlet. Combined, the two flaws let an attacker execute code remotely without ever needing a valid account, establishing an initial foothold on the server.

The centerpiece of the chain is a critical deserialization vulnerability, carrying a CVSS score of 9.8, affecting PTC Windchill PDMLink and FlexPLM releases prior to version 11.0 M030. It was disclosed in mid-June, and CISA added it to its Known Exploited Vulnerabilities catalog roughly a week later, a strong signal that active exploitation was already underway in the wild.

• Initial reconnaissance hits the FlexPLM WSDL endpoint to gather information without authentication.
• A chained login servlet weakness enables unauthenticated remote code execution.
• Operators deploy JSP webshells to maintain access and browse server contents.
• Sensitive engineering files are staged and exfiltrated ahead of any extortion demand.

Mass Internal Extortion Emails

Starting July 20, Ransom-ISAC began observing a wave of emails carrying the subject line referencing a “Windchill PDMLink module serious data leak,” sent not to a single executive contact but to hundreds of employees across each affected organization. That distribution pattern is deliberate: spreading the breach allegation internally builds pressure on executives and incident response teams well before any data is named publicly, and it mirrors extortion tactics seen in last year’s Oracle E-Business Suite campaign, albeit sent from a fresh set of email addresses this time around.

Organizations that receive these messages are advised to preserve the emails and their headers, validate the underlying claim through an internal investigation rather than reacting to the message alone, and remind staff to report anything suspicious rather than engage directly, since the same wave of attention often invites follow-on phishing attempts targeting rattled employees.

What Security Teams Should Do Now

Because the entry point is a public-facing application rather than a phished mailbox, this campaign is a useful reminder that internet-exposed enterprise software needs the same urgency around patching as anything facing the open internet. Ransom-ISAC recommends organizations hunt for signs of compromise dating back to early June, apply PTC’s fixed builds immediately, and review access logs specifically for the reconnaissance request pattern associated with the WSDL endpoint. Security teams should also check for unexpected JSP files on Windchill and FlexPLM servers and monitor for unusual outbound network activity, while keeping an eye on the CISA KEV catalog to prioritize patching work around flaws already confirmed as exploited in the wild.

Indicators shared alongside the report include several command-and-control IP addresses, a published file hash, a distinctive malicious request header, and a hunt pattern for hex-named JSP webshells dropped under the Windchill login path. As with most active extortion campaigns, the greatest risk lies with organizations that have not yet identified that they are exposed at all; continuous discovery of internet-facing PLM systems, not just periodic audits, is what ultimately closes that gap.