Cl0p-linked actors exploit internet-exposed PTC Windchill and FlexPLM in data extortion campaign

70/100

Threat actors linked to Cl0p are exploiting internet-exposed PTC Windchill and FlexPLM deployments. They chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet. Organisations running these products should restrict internet exposure and apply vendor fixes or mitigations.