Reports say a JavaServer Pages (JSP) web shell is being used to support attacks targeting PTC Windchill and FlexPLM servers. Security researchers say the shell is deployed after exploitation of a critical vulnerability affecting these enterprise systems and is tailored to the software’s architecture, including access to underlying file repositories.
Bleeping Computer and The Hacker News both describe the web shell as capability-focused tooling rather than a simple foothold. It reportedly includes functions to decrypt or recover credentials, enumerate and access stored data locations, and steal files. The Hacker News characterizes the activity as part of an extortion-capable setup, while Bleeping Computer emphasizes the shell’s custom design for data theft from Windchill/FlexPLM.
Both accounts attribute the activity to Clop, commonly associated with ransomware-driven extortion campaigns, based on observed tooling and linkage. The outlets’ differences mainly reflect how they frame the end goal—data theft versus extortion platform—while aligning on the core technical behavior and the targeted systems.
