UPDATE — Cl0p's Windchill implant, reverse-engineered: a custom request header carries the commands, one of them decrypts the whole keystore including the LDAP manager password, and a built-in class loader turns it into an unlimited backdoor
UPDATE · originally covered UPDATE — the Cl0p Windchill wave gets its first victim confirmations: Philips says a server was hit and contained, Shell says it is investigating, and a second vendor puts JSP webshells on the compromised platforms (2026-08-15)
the campaign's post-exploitation tooling now has a published mechanism, and it is not a generic web shell. ReliaQuest's threat research team released a reverse-engineering analysis on 2026-08-18 of the implant deployed after exploitation of CVE-2026-12569 in PTC Windchill, stating that "This activity was highly likely conducted by the Clop extortion group" (ReliaQuest, 2026-08-18). The prior entry recorded only that JSP web shells were being deployed; what follows is the mechanism, which changes what a defender can look for.
Background. Cl0p's pattern is well documented over several years and is the reason a single flaw in a data-holding enterprise platform reliably becomes a mass-extortion wave rather than an isolated intrusion. ReliaQuest places this implant in a lineage: the group deployed the custom web shell DEWMODE after exploiting CVE-2021-27101, and LEMURLOOT after exploiting CVE-2023-34362 (ReliaQuest, 2026-08-18). BleepingComputer's account of the group's history adds the platform list those campaigns ran through — Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo and MOVEit Transfer, the last of which affected more than 2,770 organisations — along with an Oracle E-Business Suite zero-day campaign from early August 2025 (BleepingComputer, 2026-08-17). Each followed the same order: pick software that stores other people's sensitive data, exploit it at scale immediately after disclosure, deploy a purpose-built shell, then extort from the stolen data rather than from encryption.
What the implant does
The single most consequential command is a credential dump. ReliaQuest states that "A single \"S\" command to the web shell returns Windchill's directory-management and administrative credentials in plaintext" (ReliaQuest, 2026-08-18), implemented by an internal function the analysis calls gs in three steps: read Windchill's ieStructProperties.txt configuration file, decrypt the LDAP manager password from the application keystore, then iterate every stored local property decrypting the remaining encrypted values — administrative account credentials, object-storage credentials and all site administrator keys. Because LDAP credentials in most estates govern directory authentication for Active Directory, mail, VPN and whatever else federates against it, ReliaQuest's reading is that this turns one application compromise into an enterprise-wide credential compromise. A separate command exfiltrates the result.
Discovery is equally application-aware. A function fl, backed by a class the analysis names Flst1, queries Windchill's database for vault stream identifiers, filenames, storage paths and file sizes, writing the result to a file named flst.txt — a ready-made index of the repository from which the operator picks what to steal. The helper that opens that database connection uses Windchill's own internal Java classes, and this is the detection problem rather than a footnote: the implant connects through the application's MethodContext and WTConnection classes, so "its queries run under the application’s existing database identity rather than through a separately configured attacker account" (ReliaQuest, 2026-08-18). Database telemetry attributes the theft to the application's normal service account.
The third component is what makes the shell open-ended. A custom Java class loader the analysis calls Cldr takes attacker-supplied code as a Base64-encoded ZIP: "It accepts a Base64-encoded ZIP file containing compiled Java bytecode, loads it directly into memory, and executes it" (ReliaQuest, 2026-08-18). Nothing is written to disk, and the capability set is therefore not fixed at deployment — ReliaQuest notes the same channel could carry propagation tooling or file-encrypting payloads, which is a stated possibility rather than observed activity and is carried here as such.
Why ordinary monitoring misses it
Commands travel in a custom HTTP request header, X-windchill-req, rather than in a URL or a request body, and responses are GZIP-compressed so the returned data looks like ordinary compressed web content. ReliaQuest is explicit about what that costs a defender: controls inspecting only URL paths or body parameters see no command traffic at all, and controls that log headers without decompressing responses "will capture the instructions but miss the data being returned". Its conclusion is a three-part requirement — "Identifying this activity requires header logging that captures non-standard values, response decompression, and TLS inspection; without all three, coverage against this web shell's traffic is partial at best" (ReliaQuest, 2026-08-18). The analysis contrasts this with China Chopper, which it offers as the reusable-shell baseline: widely available, application-agnostic, and carrying the known patterns signature-based controls are built around. This implant carries none of them, because it behaves like the application.
Hunting and response
The hunt has three independent footholds, and the file-system one is the cheapest. ReliaQuest's own guidance is to "Review the windchill/codebase/login directory and other Windchill codebase paths on all Windchill servers for unexpected JavaServer Pages (JSP) files that could be web shells", prioritising recent modification timestamps, unfamiliar filenames, or content referencing the X-windchill-req header, MethodContext, WTConnection or WTKeyStoreUtil (ReliaQuest, 2026-08-18). In web-tier telemetry, the signal is requests to Windchill carrying a non-standard request header at all — the header name is the artifact, and an estate that logs only method, path and status will not have recorded it. In file and database telemetry, the creation of flst.txt on a Windchill server and vault-table enumeration queries that select stream identifiers and storage paths in bulk are both discoverable, as is a large outbound transfer following shortly after.
Triage: every one of these signals has a benign twin on a healthy PLM server, which is why the sequence rather than any single event is the discriminator. Windchill queries its own vault tables constantly and always under the service identity, so identity is useless as a filter and volume nearly so; what does not happen normally is a bulk enumeration of stream identifiers, filenames and sizes landing in a text file in a codebase directory, followed by an outbound transfer, followed by authentication attempts elsewhere in the estate using the LDAP manager account. Likewise, JSP files legitimately live in Windchill's codebase — a recently modified one with an unfamiliar name that references the application's keystore utility class does not.
A single "S" command to the web shell returns Windchill's directory-management and administrative credentials in plaintext.
It accepts a Base64-encoded ZIP file containing compiled Java bytecode, loads it directly into memory, and executes it.
Identifying this activity requires header logging that captures non-standard values, response decompression, and TLS inspection; without all three, coverage against this web shell's traffic is partial at best.
This activity was highly likely conducted by the Clop extortion group.
While a GE spokesperson said the company is aware of the claim and is "working to assess the potential issue," a Philips spokesperson confirmed its systems were breached but said the incident has been contained and didn't affect customers.
Defender actions
- On every Windchill server, review the windchill/codebase/login directory and the other codebase paths for unexpected JSP files, prioritising recent modification timestamps and any file whose content references X-windchill-req, MethodContext, WTConnection or WTKeyStoreUtil — ReliaQuest's own stated hunt criteria.
- On any Windchill server confirmed or suspected compromised, rotate the LDAP manager password and every other credential held in the application keystore, treat the full set as exfiltrated, and terminate existing sessions for those accounts — rotated passwords alone leave issued tokens valid.
ATT&CK mapping
9 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Persistence TA0003
T1505.003Server Software Component: Web Shell
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
Stealth TA0005
T1620Reflective Code Loading
Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).
Credential Access TA0006
T1552.001Unsecured Credentials: Credentials In Files
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
T1555Credentials from Password Stores
Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
Collection TA0009
T1213Data from Information Repositories
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).
Command and Control TA0011
T1071.001Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Exfiltration TA0010
T1041Exfiltration Over C2 Channel
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Impact TA0040
T1657Financial Theft
Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.