UPDATE — Cl0p Windchill campaign status: the implant is now reverse-engineered and one command is shown to return the whole application keystore in plaintext, while the named-victim count has stopped moving and one heavyweight name quietly left the leak site

UPDATE · originally covered Cl0p PTC Windchill campaign status: the extortion wave crossed from leak-site assertion to partial victim corroboration this week — Philips and Shell responded, European organisations appeared among the named listings, and a second vendor confirmed the webshell artefact PTC had already documented (2026-08-16)

the prior weekly recorded this campaign crossing from leak-site assertion to partial victim corroboration — Philips and Shell responding, European organisations among the listings, a second vendor corroborating the web-shell artefact PTC had already documented. This week the assertion side has gone quiet and the technical side has opened up.

The implant is documented, and the credential exposure is now specific. ReliaQuest's reverse engineering, published 2026-08-18, states the activity was highly likely conducted by Cl0p and describes something purpose-built against Windchill rather than a generic shell. The single most consequential capability is a credential dump: "A single \"S\" command to the web shell returns Windchill's directory-management and administrative credentials in plaintext" — implemented by reading the application's configuration file, decrypting the LDAP manager password from the keystore, and then iterating every remaining stored property to decrypt administrative account credentials, object-storage credentials and all site administrator keys (ReliaQuest, 2026-08-18). That converts a single application compromise into a directory compromise wherever the LDAP manager account governs authentication for the wider estate. Two further properties matter for anyone hunting: commands arrive in a custom HTTP request header rather than in a URL or body, so controls inspecting only paths and parameters see no command traffic at all; and the implant's database queries run through Windchill's own connection classes, so database telemetry attributes the theft to the application's normal service identity.

The victim list has stopped growing. Follow-on coverage through 2026-08-21 adds no new named victims and no new technical developments, and the count that has been in circulation since 2026-08-15 — in the low-to-mid forties, with different trackers and outlets disagreeing by one or two — has not moved. ISMG's own framing puts the group's claim at more than 40 firms (GovInfoSecurity, 2026-08-17). A plateau is not evidence that exploitation has stopped; Cl0p's historical pattern is to publish in batches, and ReliaQuest assesses with high confidence that exploitation will expand to more organisations in the coming weeks.

One name left the list, and two more bounded their exposure. ISMG reports that "GE is no longer on Clop's darkweb leak site of companies that have not contacted it to negotiate a payoff", framing the removal as consistent with either a ransom payment or a resumed negotiation (GovInfoSecurity, 2026-08-17). This run could not find a second outlet that checked the listing itself, so that observation is one outlet's and is carried as such — but it is worth recording precisely because it is the only publicly visible signal of a negotiation outcome anywhere in this campaign. Two other named companies gave first statements to the same outlet, both bounding rather than denying: Toast, from which the group claims files, said "Toast identified unauthorized access to a limited number of files; to date, the files identified contain nonsensitive internal documents," adding that it isolated the affected systems the same day it detected the activity and considers the situation contained; Fiserv, from which the group claims 874 gigabytes including computer-aided design files, said none of its customer, bank, transaction or personal data were stolen based on a comprehensive review to date (GovInfoSecurity, 2026-08-17).