Clop has returned with another mass-exploitation and data-extortion campaign, continuing its established strategy of targeting widely deployed enterprise applications. The latest activity focuses on internet-exposed PTC Windchill and FlexPLM environments through CVE-2026-12569, a critical remote code execution vulnerability involving unsafe deserialization and rated CVSS 9.8. The campaign reflects the same broader pattern seen in Clop’s earlier operations against file-transfer platforms, where a single vulnerability can provide access to large numbers of organizations. This approach is consistent with Clop’s exploitation of CVE-2021-27101 in Accellion FTA and CVE-2023-34362 in Progress MOVEit Transfer. Rather than relying primarily on ransomware encryption, Clop emphasizes large-scale data theft followed by extortion.
The campaign demonstrates Clop’s continued use of vulnerability exploitation, web shells and custom implants for post-exploitation. CVE-2026-12569 enables unauthenticated remote code execution in vulnerable Windchill and FlexPLM deployments and has been associated with JSP web-shell deployment and sensitive engineering-data exfiltration. CVE-2021-27101 was an SQL injection vulnerability in Accellion FTA that enabled Clop to gain access to file-transfer environments and steal sensitive data. In the MOVEit campaign, CVE-2023-34362 was exploited as a SQL injection flaw, allowing attackers to deploy the LEMURLOOT web shell, interact with databases and exfiltrate information. These campaigns demonstrate Clop’s recurring attack chain of exploiting internet-facing software, establishing web-based access, locating valuable information, exfiltrating data and conducting extortion.[/subscribe_to_unlock_form]
Clop has returned with another mass-exploitation and data-extortion campaign, continuing its established strategy of targeting widely deployed enterprise applications. The latest activity focuses on internet-exposed PTC Windchill and FlexPLM environments through CVE-2026-12569, a critical remote code execution vulnerability involving unsafe deserialization and rated CVSS 9.8. The campaign reflects the same broader pattern seen in Clop’s earlier operations against file-transfer platforms, where a single vulnerability can provide access to large numbers of organizations. This approach is consistent with Clop’s exploitation of CVE-2021-27101 in Accellion FTA and CVE-2023-34362 in Progress MOVEit Transfer. Rather than relying primarily on ransomware encryption, Clop emphasizes large-scale data theft followed by extortion.
The campaign demonstrates Clop’s continued use of vulnerability exploitation, web shells and custom implants for post-exploitation. CVE-2026-12569 enables unauthenticated remote code execution in vulnerable Windchill and FlexPLM deployments and has been associated with JSP web-shell deployment and sensitive engineering-data exfiltration. CVE-2021-27101 was an SQL injection vulnerability in Accellion FTA that enabled Clop to gain access to file-transfer environments and steal sensitive data. In the MOVEit campaign, CVE-2023-34362 was exploited as a SQL injection flaw, allowing attackers to deploy the LEMURLOOT web shell, interact with databases and exfiltrate information. These campaigns demonstrate Clop’s recurring attack chain of exploiting internet-facing software, establishing web-based access, locating valuable information, exfiltrating data and conducting extortion.[emaillocker id="1283"]
The three vulnerabilities illustrate how Clop has refined its mass-extortion model across different enterprise technologies. CVE-2021-27101 demonstrated the exploitation of a managed file-transfer appliance for large-scale data theft, while CVE-2023-34362 enabled the MOVEit campaign and showed the impact of exploiting a widely deployed file-transfer platform. The latest CVE-2026-12569 campaign extends this approach to product lifecycle management systems, with attackers using remote code execution and JSP web shells to access valuable engineering and business information. The common element is Clop’s preference for exploiting externally accessible applications at scale and monetizing stolen information rather than depending exclusively on encryption. Organizations should prioritize internet-facing asset discovery, rapid vulnerability remediation, web-shell detection, strong access controls and monitoring for abnormal data access and outbound transfers.
We recommend you to refer below link: https://www.cve.org/CVERecord?id=CVE-2026-12569
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial access | T1190 | Exploit Public | Facing Application- |
| Persistence | T1543.003 | Create or Modify System Process | Windows Service |
| Credential access | T1555.003 | Credentials from Password Stores | Credentials from Web Browsers |
| Lateral Movement | T1021.001 | Remote Services | Remote Desktop Protocol |
| Collection | T1005 | Data from Local System | - |
| Command and control | T1071.001 | Application Layer Protocol | Web Protocols |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | - |
The following reports contain further technical details:
[/emaillocker]