Cl0p Ransomware Affiliate Group Suspected of Exploiting PTC Windchill and FlexPLM Vulnerabilities

Digitaltrends reporter Hwang Chigyu reports that Cl0p ransomware affiliate groups are suspected of exploiting a critical remote code execution (RCE) vulnerability in PTC's Product Lifecycle Management (PLM) platforms, Windchill and FlexPLM. According to SecurityWeek, the vulnerability (CVE-2026-12569) has a CVSS score of 9.3, allowing attacks without login by processing unvalidated data. The patch was released on June 17, with PTC disclosing indicators of compromise (IoCs) the following day, confirming real-world exploitation. It was also added to CISA's Known Exploited Vulnerabilities (KEV) list. Llama Quest, ransom-ISAC, and other groups warn that Cl0p affiliates are actively exploiting the vulnerability. Llama Quest notes that the observed tactics resemble past Cl0p campaigns targeting enterprise applications and high-value data stores, though the attacker's origin remains unidentified.