# Clop Cybercrime Group Exploits PTC Vulnerability in Major Data Theft Campaign

*Published August 21, 2026*
*Source: [https://cyberscoop.com/clop-zero-day-attacks-ptc-windchill-flexplm/](https://cyberscoop.com/clop-zero-day-attacks-ptc-windchill-flexplm/)*

## Executive Summary

Clop exploited a critical zero-day vulnerability in PTC's software, impacting various organizations and leading to extensive data theft. This attack highlights Clop's continued focus on exploiting vulnerabilities for mass data exfiltration.

## Article

The Clop cybercrime group has executed a significant data theft operation by exploiting a critical zero-day vulnerability in PTC's Windchill and FlexPLM software. This breach has impacted a wide range of organizations, including prominent publicly traded companies. Clop, known for its strategic attacks since 2020, began its latest campaign by targeting this vulnerability, which affects manufacturers and retailers in industries such as aerospace and automotive. PTC disclosed the vulnerability, identified as CVE-2026-12569, on June 17 and issued a patch shortly after, but some organizations had already been compromised by early June. The Cybersecurity and Infrastructure Security Agency quickly added this defect to its known exploited vulnerabilities catalog.

Clop's victims include companies like GE, Philips, and Shell, though many have not commented on the impact. Researchers have discovered that Clop used a custom web shell to facilitate credential and data theft, enabling the group to act quickly and efficiently. This toolkit mimics Windchill's standard functions, making it difficult for defenders to detect malicious activity. Clop's operation follows a pattern of exploiting zero-day vulnerabilities in widely used software, allowing them to access and steal sensitive data over extended periods. Previous campaigns have seen similar success, such as the infiltration of MOVEit environments in 2023, which exposed data from over 2,300 organizations. This ongoing situation underscores the persistent threat posed by Clop and the need for robust cybersecurity measures.