The Clop cybercrime group is at it again — this time exploiting a zero-day vulnerability in PTC's Windchill and FlexPLM software, tools widely used in manufacturing, aerospace, and automotive industries. The group began sending extortion emails to victims in mid-July, claiming it stole data from dozens of organizations, potentially including GE, Philips, and Shell.
PTC disclosed the flaw (CVE-2026-12569) on June 17, but companies were likely compromised weeks earlier. Clop deployed a custom web shell purpose-built for Windchill, enabling rapid credential theft and data exfiltration with minimal detection. Toast and Zebra confirmed intrusions but say impacts were limited. The fallout is still unfolding.
Source: CyberScoop