Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. "Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling

The article reports that Cl0p ransomware affiliates are exploiting a critical unauthenticated RCE vulnerability (CVE-2026-12569) in internet-exposed PTC Windchill PDMLink and FlexPLM by chaining a FlexPLM WSDL information disclosure with a Windchill login servlet deserialization flaw to deploy web shells and steal engineering and product lifecycle data.[1] This continues Cl0p’s pattern of abusing exposed, business-critical enterprise applications for data extortion rather than purely encryption-based ransomware.[1][4] From a RealGround perspective, any SaaS-like or internet-exposed PLM/ERP platform integrated with AI agents (for design assistance, document summarization, or workflow automation) inherits elevated risk of data leakage and compromise of AI-connected credentials and integration keys when these core systems are breached.[1] Organizations should treat PLM/ERP platforms as high-risk upstream dependencies for AI workflows, minimizing internet exposure, rapidly patching, and integrating these systems into AI security readiness assessments and threat models so that a compromise of PLM/ERP does not cascade into AI agents, their prompts, or associated sensitive training and in