CTO at NCSC Weekly Summary (week ending July 26, 2026): Cl0p PTC Windchill/FlexPLM exploitation (CVE-2026-12569), SonicWall SMA 1000 zero-days (CVE-2026-15409/CVE-2026-15410), and multi-actor state-linked activity

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5637 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Cl0p PTC Windchill/FlexPLM CVE-2026-12569 WSDL Recon, X-windchill-req And JSP Webshell Access

Behaviour-first detection of Cl0p exploitation of PTC Windchill PDMLink/FlexPLM (CVE-2026-12569, CISA KEV, CWE-502): GET /Windchill/rfa/jsp/login/*.jsp?wsdl reconnaissance, a malicious X-windchill-req header, requests to hex-named JSP webshells under /Windchill/login/, and traffic from Ransom-ISAC listed Cl0p IPs. Catches the pre-auth chain before double-extortion data staging.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1505.003
• Data sources: web_access_logs, iis, apache_access, stream_http
• Severity: critical
• Confidence: high

Splunk SPL

index=web (sourcetype=access_combined OR sourcetype=iis OR sourcetype="stream:http" OR sourcetype=apache:access) "Windchill" earliest=-24h
| eval src=coalesce(src_ip, clientip, c_ip), uri=coalesce(uri_path, cs_uri_stem, uri), qs=coalesce(uri_query, cs_uri_query, "")
| eval wsdl_recon=if(match(uri,"(?i)/Windchill/rfa/jsp/login/[^/]*[.]jsp") AND match(qs,"(?i)wsdl"),1,0)
| eval hdr_hit=if(match(_raw,"(?i)X-windchill-req"),1,0)
| eval webshell_req=if(match(uri,"(?i)^/Windchill/login/[0-9a-f]{6,}[.]jsp$"),1,0)
| eval known_ip=if(in(src,"216.152.148.54","216.152.151.204","104.243.35.63","5.180.41.35","79.141.160.78"),1,0)
| where wsdl_recon=1 OR hdr_hit=1 OR webshell_req=1 OR known_ip=1
| stats count as hits min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(status) as http_status max(wsdl_recon) as wsdl_recon max(hdr_hit) as xwindchill_req_header max(webshell_req) as webshell_request max(known_ip) as cl0p_known_ip by src, host
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table first_seen last_seen host src hits uris http_status wsdl_recon xwindchill_req_header webshell_request cl0p_known_ip

Microsoft KQL

let cl0p_ips = dynamic(["216.152.148.54","216.152.151.204","104.243.35.63","5.180.41.35","79.141.160.78"]);
W3CIISLog
| where TimeGenerated > ago(24h)
| where csUriStem has "/Windchill/"
| extend wsdl_recon = csUriStem matches regex @"(?i)/Windchill/rfa/jsp/login/[^/]*[.]jsp" and csUriQuery has "wsdl"
| extend webshell_req = csUriStem matches regex @"(?i)^/Windchill/login/[0-9a-f]{6,}[.]jsp$"
| extend known_ip = cIP in (cl0p_ips)
| where wsdl_recon or webshell_req or known_ip
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Uris=make_set(csUriStem, 20), Statuses=make_set(scStatus, 10), WsdlRecon=max(wsdl_recon), WebshellReq=max(webshell_req), Cl0pIp=max(known_ip) by cIP, sSiteName, Computer
| project FirstSeen, LastSeen, Computer, sSiteName, cIP, Hits, Uris, Statuses, WsdlRecon, WebshellReq, Cl0pIp

Sigma

title: PTC Windchill FlexPLM WSDL Recon And Webshell Access - CVE-2026-12569
id: 3b0f6a52-8d1e-4c47-9a2b-5e7c1d9f4a10
status: experimental
description: Detects web requests tied to Cl0p exploitation of PTC Windchill/FlexPLM CVE-2026-12569 - WSDL reconnaissance against /Windchill/rfa/jsp/login/*.jsp, hex-named JSP webshell requests under /Windchill/login/, and requests from Ransom-ISAC listed Cl0p source IPs.
references:
    - https://ransom-isac.org/blog/clop-windchill-flexplm-exploitation/
    - https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-july-e89
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - cve.2026.12569
logsource:
    category: webserver
detection:
    selection_wsdl:
        cs-uri-stem|re: '(?i)/Windchill/rfa/jsp/login/[^/]*[.]jsp'
        cs-uri-query|contains: 'wsdl'
    selection_shell:
        cs-uri-stem|re: '(?i)^/Windchill/login/[0-9a-f]{6,}[.]jsp$'
    selection_ip:
        c-ip:
            - '216.152.148.54'
            - '216.152.151.204'
            - '104.243.35.63'
            - '5.180.41.35'
            - '79.141.160.78'
        cs-uri-stem|contains: '/Windchill'
    condition: 1 of selection_*
falsepositives:
    - Authorised vulnerability scanners probing the FlexPLM WSDL endpoint
    - 104.243.35.0/24 is shared hosting; validate before blocking
level: high

Known false positives:

• Authorised vulnerability scanners or asset-discovery tools requesting the FlexPLM WSDL endpoint
• 104.243.35.63 sits in shared hosting (104.243.35.0/24); legitimate tenants may appear
• Internal PTC support tooling requesting login JSPs with a WSDL query

Tuning notes: Tune the sourcetype list and field aliases (uri_path/cs_uri_stem, src_ip/c_ip) to the Windchill front-end in use. The X-windchill-req header is only matched when the web tier logs raw headers (stream:http, WAF or a custom log format); otherwise rely on the WSDL, webshell-path and IP branches. Exclude approved scanner addresses via a NOT src filter. Treat any 200 response on a hex-named /Windchill/login/ JSP as a confirmed webshell. Patch to releases from PTC advisory CS473270.

• 🔒 SonicWall SMA 1000 UTA0533 /wsproxy Tunnel Exploitation (CVE-2026-15409/CVE-2026-15410) · unlock with TL Creds
• 🔒 HelloNet ViPNet [indicator] [indicator] Sideload And UAC-0099 [indicator] Masquerade · unlock with TL Creds
• 🔒 msaRAT Headless Browser CDP Control With Workers.dev WebRTC Signaling · unlock with TL Creds
• 🔒 cPanel/WHM Pre-Disclosure Login Probing (CVE-2026-41940, [indicator]) · unlock with TL Creds
• 🔒 SonicWall SMA 1000 Post-Exploitation - ROOTRUN xzfind, KNUCKLEBALL, Suo5 And ORANGETAIL · unlock with TL Creds
• 🔒 C2 Domain Resolution - [indicator] And ols-img-12.workers.dev · unlock with TL Creds
• 🔒 Cl0p Windchill Post-Exploitation - Hex-Named JSP Webshell And flst.txt Written · unlock with TL Creds
• 🔒 C2 And Staging Infrastructure Contacts - Cl0p, UTA0533, HelloNet, VShell/Hades, msaRAT, PatchAgent · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 32 indicators of compromise for TL-2026-5637.

Sample indicators (3 of 32)

• IP address: 43.246.208[.]207
• Domain: redhatupdating432[.]dnsrd[.]com
• File hash: 81a9af3846bad3a1107164ff7cf0a08e020b31a3b32fd17866e17d4c1565f7f2

Defanged, TLP:CLEAR. Full set of 32 indicators: unlock with TL Creds.

Community OSINT corroboration

7 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Primary reports were fetched and summarised here.

This record tracks a weekly threat-intelligence roundup published by the CTO at NCSC (Ollie Whitehouse) on 2026-07-25. It is a secondary aggregator; facts below come from the newsletter and the primary reports it links, each fetched and read for this analysis.

Cl0p / PTC Windchill and FlexPLM (CVE-2026-12569): Ransom-ISAC reports a critical (CVSS 3.1 9.8) deserialization-of-untrusted-data RCE in PTC Windchill PDMLink and FlexPLM, affecting releases prior to 11.0 M030. It was disclosed 2026-06-17 and added to CISA KEV on 2026-06-25. The chain pairs a pre-authentication information disclosure in the FlexPLM WSDL endpoint (CVSS 7.5) with a flaw in the Windchill login servlet. Recon uses GET /Windchill/rfa/jsp/login/*.jsp?wsdl, a malicious X-windchill-req header is observed, and JSP webshells (hex-named, under /Windchill/login/) are written for persistence. Post-exploitation includes filesystem enumeration (flst.txt) and staging of engineering/design data for double extortion. Extortion emails titled 'Windchill PDMLink module serious data leak' have been sent to hundreds of users per victim. Victim sectors: manufacturing, automotive, aerospace, retail/apparel. Ransom-ISAC lists Cl0p aliases Graceful Spider, Chubby Scorpius, FIN11 and Lace Tempest.

SonicWall SMA 1000 (CVE-2026-15409, CVE-2026-15410): Volexity tracks the exploiting actor as UTA0533 and makes no country or group attribution. An unauthenticated /wsproxy request (User-Agent 'SMA Connect Agent', bmID beginning -3389) gives a WebSocket tunnel to localhost-only services (CouchDB 1050, EPMD 1051, control service 8188); CouchDB default credentials allow file write and execution as the couchdb user; a path-traversal in sysCtrl.execRemoveHotfix then executes /tmp/1234.sh as root. Implants: ROOTRUN (setuid /usr/bin/xzfind), KNUCKLEBALL (Java Attach API injector), a modified Suo5 tunnel and the ORANGETAIL Behinder-like webshell, gated on a fake Chrome/149 User-Agent. Earliest compromise was observed 2026-06-22; SonicWall disclosed on 2026-07-14. Affected models 6210, 7210 and 8200v; fixed in 12.4.3-03453 and 12.5.0-02835.

Russia: the UK NCSC and 14 partner countries exposed LAUNDRY BEAR, assessed as almost certainly Russian state-supported, active since July 2025. Its zero-click 'beehive' ('Ulej') exploit compromises a Zimbra Collaboration Suite webmail account when a malicious email is merely viewed, stealing email data and holding persistent mailbox access. The technique was trialled in Ukraine before use against NATO members; the NCSC page names no CVEs. CERT-UA also reports UAC-0099 shifting to a disguised NppExport.dll Notepad++ plugin.

China-linked: Hunt.io documents an unattended Hermes AI agent and the Go 'Hades' implant plus VShell against Thailand's Ministry of Finance from 43.246.208.207 (low-to-medium confidence Chinese-speaking actor); Kaspersky reports HelloNet/HelloBackdoor abusing the ViPNet Update System via DLL sideloading (wtsapi32.dll loaded by itcsrvup64.exe) against Russian organisations (low confidence, Chinese-speaking APT); Group-IB tracks JadeProx and TriBack Loader/AdaptixC2 as China-nexus. Iran: CISA AA26-097A (revised 2026-07-22) covers Iranian-affiliated actors manipulating PLCs in US water, energy and government services; Ransom-ISAC documents a MuddyWater ClickFix lure delivering the three-stage PatchAgent loader. Other items: Talos reports Chaos ransomware's msaRAT driving a headless browser over Chrome DevTools Protocol with a WebRTC C2 channel, and Honeylabs observed probing of cPanel/WHM CVE-2026-41940 17 days before the vendor advisory.

CVSS scores are not stated for most items in the newsletter, so the record-level score is left null. Severity HIGH is an analyst judgment based on active exploitation, not a source-stated rating.

MITRE ATT&CK techniques by tactic:

Persistence

T1037.004 RC Scripts; T1505.003 Web Shell; T1546.015 Component Object Model Hijacking; T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1040 Network Sniffing

Defense Evasion

T1055 Process Injection; T1055.012 Process Hollowing; T1070.004 File Deletion; T1218.010 Regsvr32; T1574.001 DLL

Execution

T1059 Command and Scripting Interpreter; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• PTC Windchill/FlexPLM fixed builds (releases prior to 11.0 M030 affected)
• SonicWall SMA 1000 12.4.3-03453 and 12.5.0-02835

Immediate actions

• Apply PTC fixes for CVE-2026-12569 and hunt /Windchill/login/ for hex-named JSP webshells; block vetted IOCs from PTC advisory CS473270
• Upgrade SonicWall SMA 1000 (6210, 7210, 8200v) to 12.4.3-03453 or 12.5.0-02835 and review conf.json for routes to 127.0.0.1:8085 and setuid binaries (find / -perm -4000)
• Patch Zimbra Collaboration Suite immediately per NCSC advisory
• Remove PLCs from direct internet exposure per CISA AA26-097A

Workarounds

• Validate network indicators before blocking, as some may be shared hosting
• Place Rockwell controllers' physical mode switch in RUN and restrict PLC network access with ACLs

Longer-term hardening

• Monitor outbound and lateral connections from edge appliances such as SMA
• Alert on DLL sideloading from vendor update components (for example itcsrvup64.exe loading wtsapi32.dll)
• Sign up for the NCSC Early Warning service

Affected and fixed versions

• PTC — Windchill PDMLink and FlexPLM
  Vulnerable versions: releases prior to 11.0 M030
  Fixed in: fixed builds per PTC advisory CS473270
• SonicWall — SMA 1000 (6210, 7210, 8200v)
  Vulnerable versions: versions prior to fixed releases (range not stated by Volexity)
  Fixed in: 12.4.3-03453; 12.5.0-02835
• Synacor/Zimbra — Zimbra Collaboration Suite webmail
  Vulnerable versions: vulnerable versions (not named by NCSC)
• cPanel — WHM
  Vulnerable versions: not stated
• InfoTeCS — ViPNet Update System
  Vulnerable versions: abused via DLL sideloading

Timeline

• 2026-04-11 Honeylabs observes the first probe of the cPanel WHM login path from locked-ioc-18, 17 days before the vendor advisory for CVE-2026-41940
• 2026-06-17 CVE-2026-12569 (PTC Windchill/FlexPLM RCE) disclosed; early-June zero-day exploitation suspected but unconfirmed
• 2026-06-22 Earliest observed SonicWall SMA 1000 compromise by UTA0533 (xzfind/ROOTRUN written, KNUCKLEBALL deployed, init.d persistence added)
• 2026-06-25 CVE-2026-12569 added to the CISA Known Exploited Vulnerabilities catalog
• 2026-07-09 Hunt.io begins capturing open directories on locked-ioc-12 tied to the Thailand Ministry of Finance intrusion (capture window July 9-13)
• 2026-07-14 SonicWall publicly discloses the SMA 1000 zero-days CVE-2026-15409 and CVE-2026-15410
• 2026-07-16 Kaspersky Securelist publishes the HelloNet/ViPNet campaign (active since at least May 2026)
• 2026-07-17 Volexity publishes its UTA0533 SonicWall SMA exploitation analysis
• 2026-07-20 Ransom-ISAC begins observing Cl0p extortion emails titled 'Windchill PDMLink module serious data leak'
• 2026-07-22 NCSC-led advisory on LAUNDRY BEAR's beehive/Ulej zero-click Zimbra campaign dated 22 July; Ransom-ISAC publishes the Cl0p Windchill advisory; CISA revises AA26-097A
• 2026-07-23 NCSC and 14 partner countries publicly announce the LAUNDRY BEAR exposure; Talos publishes the Chaos msaRAT analysis
• 2026-07-25 CTO at NCSC publishes the weekly summary for the week ending July 26, 2026

Sources cited

• NCSC: UK and partners expose Russian state-supported actors for new zero-click phishing campaign NCSC (UK) · Advisory · 2026-07-23
• CISA Advisory AA26-097A (Iranian-affiliated actors exploiting PLCs) CISA · Government advisory · 2026-04-07
• CERT-UA: UAC-0099 report CERT-UA · Advisory
• Ransom-ISAC: Cl0p Windchill/FlexPLM exploitation ransom-isac.org · Research · 2026-07-22
• Volexity: Proxying to Compromise SonicWall Secure Mobile Access 0-day exploitation volexity.com · Research · 2026-07-17
• Talos: Chaos msaRAT living off the browser Cisco Talos · Research · 2026-07-23
• Hunt.io: Thailand Ministry of Finance targeted with Hermes AI agent hunt.io · Research · 2026-07-23
• Hunt.io: Open directory NGINX Rift / Ghost CMS multi-CVE hunt.io · Research · 2026-07-20
• Securelist: HelloNet / ViPNet Kaspersky Securelist · Research · 2026-07-16
• Group-IB: JadeProx / TriBack Loader group-ib.com · Research · 2026-07-23
• Ransom-ISAC: MuddyWater ClickFix / PatchAgent ransom-isac.org · Research · 2026-07-15
• Honeylabs: Probe 17 days before the CVE (cPanel/WHM CVE-2026-41940) honeylabs.net · Research
• CTO at NCSC Summary: week ending July 26th ctoatncsc.substack.com · Blog · 2026-07-25

More in threat intel

• AI Lowers the Barrier to Reverse Engineering Mainstream Software and Malware (Intezer: Slack, Apple Finder, Turla)
• Operation Ghost Campus: AI Agents Steal OpenAI and DeepSeek API Keys From Exposed Servers and Harvest Data of 5,132 Chinese Students
• AI Reward Hacking and Autonomous Sandbox Escape: OpenAI ExploitGym Evaluation Models Breach Hugging Face (Schneier DEF CON 34 Keynote Op-Ed)
• Operation Snowball: Autonomous AI-Driven Intrusion Campaign Exploiting Cisco BroadWorks XSP (CVE-2026-20320) Against European Telecom
• FATF Targets Global Scam Compounds: Trafficked-Labor Fraud Operations Backed by Crypto, Instant Payments and AI-Enabled Content

More from Cl0p

• Software Supply Chain Attacks Overview: CCleaner, Codecov, SolarWinds Orion, npm Shai-Hulud, Kaseya VSA, MOVEit Transfer
• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)
• Cl0p Ransomware MFT Attack Pattern: Multi-Year Zero-Day Campaigns Against File Transfer and Enterprise Software (2020-2025)
• Estée Lauder Data Breach via Oracle E-Business Suite Zero-Day (CVE-2025-61882) — Clop Exploitation
• CVE-2026-12569: PTC Windchill PDMLink / FlexPLM Unauthenticated Deserialization RCE (CISA KEV, JSP Web Shell Campaign)

Other reports on CVE-2026-12569

• GuidePoint GRIT Q3 2026 Ransomware Report: Record 2,760 Victims, New Top Group Edges Out Qilin, ShinyHunters Expands Extortion
• Q3 2026 Record Ransomware Surge: 2,627 Claimed Attacks, Qilin and The Gentlemen Lead, Clop Resurgence via PTC Windchill CVE-2026-12569
• 2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud Exfiltration (Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi)
• CISA BOD 26-04: Risk-Based Vulnerability Remediation and CISO Reporting Mandate for FCEB Agencies

Other reports on CVE-2026-15409

• Kaspersky Q3 2026 Non-Mobile Threat Landscape: Qilin Ransomware via CVE-2026-0257, INC Ransom via SonicWall SMA1000 CVE-2026-15409/15410, macOS Stealers (PamStealer, MacSync, Overlord) and npm/PyPI/crates.io Supply-Chain Backdoors
• Edge Infrastructure Under Siege: Tenable and SentinelOne Datasets Reveal Convergent Nation-State and Criminal Exploitation of Perimeter Devices
• Sophos X-Ops: Attackers Impersonate Claude, ChatGPT, Copilot and Perplexity to Distribute Infostealers, Backdoors and Malicious Browser Extensions
• QuoIntelligence Weekly Snapshot W32 2026: DOUBLECUP ClickFix loader, UTA0533 SonicWall SMA1000 zero-day chain (CVE-2026-15409/15410), Greatness AiTM/device-code PhaaS, EtherRAT blockchain C2
• SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) Chained in Active Attacks, Assessed Ransomware Precursor

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors