#ta505
1 case
Cl0p and PTC Windchill: The Custom Implant That Turned Engineering Vaults Into an Extortion CampaignExtortion & BlackmailOT & Industrial SystemsData Breach
Cl0p and PTC Windchill: The Custom Implant That Turned Engineering Vaults Into an Extortion Campaign
Cl0p exploited an unauthenticated deserialization flaw in PTC Windchill as a zero-day in June 2026, deployed a purpose-built web shell that decrypts the application's keystore, and named 43 manufacturers, including Shell, Philips and GE. It was the second such flaw in three months.
Extortion & BlackmailOT & Industrial SystemsData Breach