Clop created custom web shell for Windchill data theft attacks
A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management (PLM) software, according to new findings from ReliaQuest. The cybersecurity company characterized the web shell as a fully equipped extortion platform capable of mapping sensitive vault data, decrypting every credential in the Windchill keystore, and running additional code by means of a custom Java class loader, turning the tool into a backdoor for remote access and post-exploitation activity, such as lateral movement, ransomware, or persistence. While threat actors are typically known to deploy lightweight web shells (or reuse open-source variants like Behinder or China Chopper) as a way to maintain remote access to compromised systems and enable basic command execution capabilities, the latest development signals the use of a bespoke web shell that's tailored to the software being exploited. The web shell is deployed following the weaponization of CVE-2026-12569 (CVSS score: 9.3), which relates to a case of improper input validation that could allow an attacker to execute arbitrary code by sending a malicious request to the network. An advisory released by Ransom-ISAC along with eCrime.ch and Defused last month attributed the malicious activity to the Clop (aka Cl0p) ransomware operation, with the threat actor dropping JSP web shells against susceptible systems. "The web shell gives attackers a direct path to credential theft and large-scale data exfiltration, with no additional tooling required," ReliaQuest said in a report shared with The Hacker News. "Unlike generic command shells, this implant decrypts credentials, delivers malware, and maps stored files for exfiltration." The web shell is assessed to be an application-specific evolution of Cl0p's tried-and-tested mass-exploitation playbook, purpose-built to single out vulnerable PTC Windchill and FlexPLM instances. "It embeds detailed knowledge of the application's APIs, database schema, keystore, and file-vault structure, enabling rapid movement from access to data theft, without external commands or additional tools," researchers John Dilgen and Connor Short said. "References to 'Clop' throughout reflect this highly likely attribution." Because the targeted applications are used to store engineering data and product designs, a successful compromise can allow the attackers to obtain proprietary data from victims, as well as sensitive credentials that could be abused to laterally move into the network and reach other systems. One of the notable features of the web shell is a single "S" command that returns Windchill's directory-management and administrative credentials in plaintext by making use of a built-in function called gs that performs the following steps - Reads Windchill's "ieStructProperties.txt" configuration file Decrypts the Lightweight Directory Access Protocol (LDAP) manager password from the application keystore Iterates through all stored local properties, decrypting additional encrypted values including administrative account credentials, object storage credentials, and all site administrator keys In the case of active compromise, the "S" command can also be used to extract the credentials used to manage the organization's LDAP directory. A separate command is then used to exfiltrate the results. "Because LDAP credentials typically govern access to Active Directory, email systems, VPN, and other enterprise services tied to directory authentication, their exposure could turn a single application compromise into an enterprise-wide credential compromise," ReliaQuest said. "The resulting privileged access fuels data theft from additional applications and storage locations, as well as persistence for follow-on attacks." ReliaQuest told The Hacker News that the web shell supports the following commands - S — Returns Windchill credentials in plaintext E — Returns the parameter value directly, likely used to test connectivity O — Returns the operating system name J — Loads and executes a Java class from a ZIP via the class loader D — Runs the file download function S — Runs the credential harvesting function L — Runs the file vault enumeration and writes "flst.txt" G — Reads an arbitrary file from the file system R — Deletes a file; used for cleanup What's more, the ability of the web shell to run attacker-supplied code in memory offers a pathway for deploying secondary payloads on demand, including tools for long-term persistence, network traversal, or data encryption. The payload takes the form of a Base64-encoded ZIP file containing compiled Java bytecode that's loaded directly into memory and executed. Some of the functions baked into the web shell are as follows - A vault enumeration capability that targets the application database to identify high-value engineering data without executing manual discovery commands Executing queries through Windchill's existing database identity rather than creating a new attacker-controlled account to reduce forensic visibility Taken together, the web shell functions more akin to an implant that conducts Windchill-specific discovery and credential access from inside the application process, while using the application's own database connections and blending in with regular Windchill traffic to evade traditional signature-based defenses. "The combination of a feature-rich implant that requires no additional tooling to begin stealing data, paired with an extensible delivery mechanism for follow-on capability, gives the adversary a complete toolkit from the moment of access," ReliaQuest said. "The attacker can therefore move quickly from initial access through data theft to further post-exploitation activity entirely within the application's own trust boundary, using the web shell's purpose-built features without executing manual commands. The approach significantly limits defenders' ability to detect the activity, as it closely mimics the application's standard functions." This is not the first time the Clop gang has deployed custom web shells. The e-crime group was previously observed dropping DEWMODE and LEMURLOOT after exploiting SQL injection flaws in Accellion (CVE-2021-27101) and MOVEit Transfer (CVE-2023-34362) file transfer software, respectively. "This campaign is another reminder that Clop remains a sleeping dragon, always looking and preparing to mass exploit vulnerabilities in software that holds sensitive data," ReliaQuest said. "The group commonly goes inactive between campaigns but springs to life with custom-built web shells whenever there is another opportunity for mass extortion."