CLOP RANSOMWARE TARGETS PTC SOFTWARE IN DATA THEFT

The Clop ransomware operation (also tracked as Cl0p) has launched a focused campaign against PTC Windchill and FlexPLM users. Both products manage product lifecycle data, making them high-value targets for industrial espionage and extortion. Windchill serves as a product lifecycle management system widely used across manufacturing and engineering sectors. FlexPLM handles similar functions with emphasis on flexibility and integration. The attacks leverage publicly accessible instances that lack proper security controls. Clop's approach follows its established pattern: exfiltrate sensitive data, then demand payment under threat of public disclosure. PTC has not publicly confirmed the vulnerability being exploited. Organizations running these platforms should immediately audit their network exposure, apply available patches, and review access logs for suspicious activity. The threat actors have previously targeted similar enterprise software to access customer intellectual property and confidential manufacturing data.