Cl0p Ransomware Affiliates Exploit Critical Flaws in PTC Software for Data Extortion

Threat actors linked to the Cl0p ransomware group are actively exploiting critical vulnerabilities in internet-exposed PTC Windchill and FlexPLM deployments. The attacks involve chaining pre-authentication information disclosure with a server-side flaw to achieve unauthenticated remote code execution and deploy web shells. Manufacturing, automotive, aerospace, and retail sectors are being targeted for data theft and extortion.