-->Clop Returns with Custom Implant in Mass-Extortion Campaign Skip to ContentHow Threat Actors Are Using AI in Real Attacks: Cheaper, Faster, Harder to Spot

How Threat Actors Are Using AI in Real Attacks:

Cheaper, Faster, Harder to Spot

Access Now

Clop Returns with Custom Implant in Mass-Extortion Campaign

ReliaQuest Threat Research Team 18 August 2026

Threat Intelligence<br>Emerging Threats<br>Agentic AI

Editor’s note: This report was authored by John Dilgen and Connor Short.<br>This is external threat intelligence from the ReliaQuest Threat Research team. The findings describe threats, vulnerabilities, and attacker activity affecting third parties and the broader threat landscape—not ReliaQuest's own environment. Nothing in this report should be interpreted as a vulnerability in ReliaQuest's systems or data.<br>Key Points<br>“Clop's” exploitation of CVE-2026-12569 in PTC Windchill has returned the group to mass exploitation, delivering a custom web shell that provides full data-theft capability from the moment of deployment, with no additional tooling required.

ReliaQuest identified the web shell as a fully equipped extortion platform: it maps sensitive vault data, decrypts every credential in the Windchill keystore, and includes a custom Java class loader that lets Clop execute any additional code inside the application process, extending the shell into an unlimited backdoor for follow-on activity such as lateral movement, ransomware, or persistence.

Immediately apply the vendor fix for CVE-2026-12569, hunt for suspicious JavaServer Pages (JSP) files in Windchill codebase directories and rotate all credentials in the Windchill keystore on any server suspected of compromise.

ReliaQuest identified a custom web shell highly likely linked to "Clop" (aka Cl0p), a financially motivated ransomware and extortion group known for mass-exploiting enterprise software vulnerabilities. The web shell is deployed after exploitation of CVE-2026-12569 (CVSS 9.3) in PTC Windchill, an industry-standard product lifecycle management (PLM) platform used by manufacturing enterprises worldwide to store engineering data and product designs. The web shell gives attackers a direct path to credential theft and large-scale data exfiltration, with no additional tooling required. Unlike generic command shells, this implant decrypts credentials, delivers malware, and maps stored files for exfiltration.<br>This appears to be an application-specific evolution of Clop's established mass-exploitation playbook. The web shell is purpose-built to target this tool: it embeds detailed knowledge of the application's APIs, database schema, keystore, and file-vault structure, enabling rapid movement from access to data theft, without external commands or additional tools. References to “Clop” throughout reflect this highly likely attribution.<br>Because this application centralizes high-value product designs and intellectual property, a single successful compromise could hand an attacker both a ready inventory of sensitive data and the credentials needed to reach systems well beyond the affected server. The web shell's built-in Java class loader can execute additional attacker-supplied code entirely in memory, leaving no files written to disk, enabling lateral movement, ransomware deployment, or long-term persistence at any point after initial compromise.<br>Read on to learn:<br>How CVE-2026-12569, a remote code execution (RCE) flaw in PTC Windchill, likely gives Clop its initial foothold.

Why a compromise can quickly escalate to an enterprise-wide credential compromise.

What makes this web shell more dangerous than generic alternatives, and how to prioritize your response.

A Purpose-Built Data-Theft Platform, not a Generic Shell<br>Through investigation, we found that the web shell arrives as a fully equipped platform with built-in functions for credential harvesting, discovery of critical information locations, arbitrary file reads, and file transfers already present from the moment of deployment. It is more than the type of conventional web shell commonly used by other attackers. Beyond its built-in toolkit, a custom Java class loader lets the threat actor run attacker-supplied Java modules inside the application process. This allows the group to add capabilities on demand, including tools for sustained access, network traversal, or data encryption.<br>The combination of a feature-rich implant that requires no additional tooling to begin stealing data, paired with an extensible delivery mechanism for follow-on capability, gives the adversary a complete toolkit from the moment of access. The attacker can therefore move quickly from initial access through data theft to further post-exploitation activity entirely within the application's own trust boundary, using the web shell's purpose-built features without executing manual commands. The approach significantly limits defenders' ability to detect the activity, as it closely mimics the application's standard...