An advanced JavaServer Pages (JSP) web shell has been identified by cybersecurity firm ReliaQuest, specifically tailored for exploiting critical vulnerabilities in PTC Windchill and FlexPLM servers. This web shell is designed to target enterprise Product Lifecycle Management (PLM) software, enabling threat actors to carry out a wide range of malicious activities.
Unlike typical lightweight web shells, this bespoke tool is equipped with sophisticated capabilities, including decrypting sensitive data, extracting credentials, and executing additional code through a custom Java class loader. This functionality transforms the web shell into a powerful backdoor for remote access and post-exploitation actions such as lateral movement, ransomware deployment, and persistence.
The deployment of this web shell follows the exploitation of CVE-2026-12569, a severe security vulnerability with a CVSS score of 9.3, which allows attackers to execute arbitrary code by sending malicious requests over the network.
Recent reports have linked this malicious activity to the Clop ransomware operation, highlighting the use of JSP web shells by threat actors to target vulnerable systems.
According to ReliaQuest’s analysis, the web shell facilitates direct credential theft and large-scale data exfiltration without the need for additional tools. It decrypts credentials, delivers malware, and maps stored files for exfiltration, making it a potent weapon in the hands of attackers.
Furthermore, the web shell is specifically tailored to exploit vulnerabilities in PTC Windchill and FlexPLM servers, leveraging detailed knowledge of the application’s APIs, database schema, keystore, and file-vault structure to swiftly move from initial access to data theft.
One notable feature of the web shell is its ability to extract Windchill’s directory-management and administrative credentials, exposing critical information that can be leveraged for further attacks.
- The “S” command, for example, retrieves Windchill credentials in plaintext, including LDAP manager passwords and other sensitive information.
Additionally, the web shell supports various commands, such as retrieving parameter values, running Java classes, downloading files, and deleting files for cleanup purposes.
Its capability to execute attacker-supplied code in memory enables the deployment of secondary payloads on demand, including tools for long-term persistence, network traversal, and data encryption.
By blending in with regular Windchill traffic and utilizing the application’s database connections, the web shell evades traditional signature-based defenses, making it difficult to detect.
This campaign highlights the threat posed by the Clop ransomware group, which remains active in exploiting vulnerabilities in software to carry out mass extortion attacks. The group’s use of custom-built web shells underscores their sophistication and persistence in targeting organizations with sensitive data.
