Clop created custom web shell for Windchill data theft attacks
2026-08-18T19:23:18Z•e44ecd44fabf7fe562254a0be32d4d978a303279f1e6b9091c624138bbc69df8
CVE-2026-54121CVE-2026-69414AzureClopFlexPLMPKIPTC WindchillWMICWindows DefenderWindows Task Hostactive exploitationcertificate authoritycredential theftdata breachdata theftfile repository enumerationliving-off-the-landransomwaresupply-chain breachweb shellzero-day
What happened
The feed highlights active and emerging cyber threats, including a Clop-linked custom web shell targeting PTC Windchill and FlexPLM servers for credential decryption, repository enumeration, and data theft; ransomware exploitation of a high-severity Windows Task Host vulnerability; major alleged cloud-account and third-party supply-chain breaches; and newly disclosed Windows and certificate-authority vulnerabilities, including CVE-2026-54121 and CVE-2026-69414. It also covers defensive testing gaps and abuse of legacy tools such as WMIC.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- e44ecd44fabf7fe562254a0be32d4d978a303279f1e6b9091c624138bbc69df8
- Enrichment time
- 2026-08-18T19:23:18Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.