securityBACKGROUND
Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthent
BACKGROUND
1 SIGNALFIRST DETECTED 25 July 2026
Narrative synthesis pending — 1 signal collected.
How the story developed
25 Jul
Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
REPORT · WHAT · The Hacker News
Other feeds and industry voices
24 Jul
Clop ransomware targets Windchill, FlexPLM in data theft attacks
The Clop ransomware gang (also tracked as Cl0p) is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign. [...]
REPORT · WHAT · BleepingComputerOPEN STORY
18 Aug
Clop created custom web shell for Windchill data theft attacks
A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials,
REPORT · HOW · BleepingComputerOPEN STORY
Sources
The Hacker News
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →