OTX Threat: Clop Returns with Custom Implant in Mass-Extortion Campaign

The Clop threat group has returned to mass exploitation tactics by leveraging CVE-2026-12569 in PTC Windchill, deploying a sophisticated custom web shell designed specifically for data theft and extortion. This purpose-built implant provides immediate full data-theft capability without requiring additional tooling, featuring built-in credential harvesting, database enumeration, and a custom Java c CVEs: CVE-2021-27101, CVE-2023-34362, CVE-2026-12569 Sectors: Manufacturing