# CTO at NCSC Weekly Summary (week ending July 26, 2026): Cl0p PTC Windchill/FlexPLM exploitation (CVE-2026-12569), SonicWall SMA 1000 zero-days (CVE-2026-15409/CVE-2026-15410), and multi-actor state-linked activity

> Weekly digest by Ollie Whitehouse (published 2026-07-25) aggregating threat reporting: Cl0p exploitation of PTC Windchill/FlexPLM (CVE-2026-12569), UTA0533 zero-day exploitation of SonicWall SMA 1000 (CVE-2026-15409, CVE-2026-15410) reported by Volexity, the NCSC-led exposure of LAUNDRY BEAR's 'beehive'/'Ulej' zero-click Zimbra email-theft campaign, and Russia, China, North Korea and Iran-linked activity. Primary reports were fetched and summarised here.

- **Published:** 2026-11-10T10:46:49Z
- **Last reviewed:** 2026-11-10T10:46:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5637
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5637.png
- **ID:** TL-2026-5637
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Cl0p
- **Detections:** 9 (1 shown free below) · **IOCs:** 32 (3 shown free below)
- **CVEs:** CVE-2026-12569, CVE-2026-15409, CVE-2026-15410, CVE-2026-41940, CVE-2026-42945, CVE-2026-26980, CVE-2026-63030, CVE-2026-60137, CVE-2017-10271, CVE-2021-4034, CVE-2021-3156, CVE-2017-7269, CVE-2026-20253, CVE-2026-4480, CVE-2024-3273, CVE-2023-27350

## Description

This record tracks a weekly threat-intelligence roundup published by the CTO at NCSC (Ollie Whitehouse) on 2026-07-25. It is a secondary aggregator; facts below come from the newsletter and the primary reports it links, each fetched and read for this analysis.

Cl0p / PTC Windchill and FlexPLM (CVE-2026-12569): Ransom-ISAC reports a critical (CVSS 3.1 9.8) deserialization-of-untrusted-data RCE in PTC Windchill PDMLink and FlexPLM, affecting releases prior to 11.0 M030. It was disclosed 2026-06-17 and added to CISA KEV on 2026-06-25. The chain pairs a pre-authentication information disclosure in the FlexPLM WSDL endpoint (CVSS 7.5) with a flaw in the Windchill login servlet. Recon uses GET /Windchill/rfa/jsp/login/*.jsp?wsdl, a malicious X-windchill-req header is observed, and JSP webshells (hex-named, under /Windchill/login/) are written for persistence. Post-exploitation includes filesystem enumeration (flst.txt) and staging of engineering/design data for double extortion. Extortion emails titled 'Windchill PDMLink module serious data leak' have been sent to hundreds of users per victim. Victim sectors: manufacturing, automotive, aerospace, retail/apparel. Ransom-ISAC lists Cl0p aliases Graceful Spider, Chubby Scorpius, FIN11 and Lace Tempest.

SonicWall SMA 1000 (CVE-2026-15409, CVE-2026-15410): Volexity tracks the exploiting actor as UTA0533 and makes no country or group attribution. An unauthenticated /wsproxy request (User-Agent 'SMA Connect Agent', bmID beginning -3389) gives a WebSocket tunnel to localhost-only services (CouchDB 1050, EPMD 1051, control service 8188); CouchDB default credentials allow file write and execution as the couchdb user; a path-traversal in sysCtrl.execRemoveHotfix then executes /tmp/1234.sh as root. Implants: ROOTRUN (setuid /usr/bin/xzfind), KNUCKLEBALL (Java Attach API injector), a modified Suo5 tunnel and the ORANGETAIL Behinder-like webshell, gated on a fake Chrome/149 User-Agent. Earliest compromise was observed 2026-06-22; SonicWall disclosed on 2026-07-14. Affected models 6210, 7210 and 8200v; fixed in 12.4.3-03453 and 12.5.0-02835.

Russia: the UK NCSC and 14 partner countries exposed LAUNDRY BEAR, assessed as almost certainly Russian state-supported, active since July 2025. Its zero-click 'beehive' ('Ulej') exploit compromises a Zimbra Collaboration Suite webmail account when a malicious email is merely viewed, stealing email data and holding persistent mailbox access. The technique was trialled in Ukraine before use against NATO members; the NCSC page names no CVEs. CERT-UA also reports UAC-0099 shifting to a disguised NppExport.dll Notepad++ plugin.

China-linked: Hunt.io documents an unattended Hermes AI agent and the Go 'Hades' implant plus VShell against Thailand's Ministry of Finance from 43.246.208.207 (low-to-medium confidence Chinese-speaking actor); Kaspersky reports HelloNet/HelloBackdoor abusing the ViPNet Update System via DLL sideloading (wtsapi32.dll loaded by itcsrvup64.exe) against Russian organisations (low confidence, Chinese-speaking APT); Group-IB tracks JadeProx and TriBack Loader/AdaptixC2 as China-nexus. Iran: CISA AA26-097A (revised 2026-07-22) covers Iranian-affiliated actors manipulating PLCs in US water, energy and government services; Ransom-ISAC documents a MuddyWater ClickFix lure delivering the three-stage PatchAgent loader. Other items: Talos reports Chaos ransomware's msaRAT driving a headless browser over Chrome DevTools Protocol with a WebRTC C2 channel, and Honeylabs observed probing of cPanel/WHM CVE-2026-41940 17 days before the vendor advisory.

CVSS scores are not stated for most items in the newsletter, so the record-level score is left null. Severity HIGH is an analyst judgment based on active exploitation, not a source-stated rating.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1059 Command and Scripting Interpreter
- T1505.003 Web Shell
- T1037.004 RC Scripts
- T1547.001 Registry Run Keys / Startup Folder
- T1546.015 Component Object Model Hijacking
- T1574.001 DLL
- T1055 Process Injection
- T1055.012 Process Hollowing
- T1218.010 Regsvr32
- T1685 Disable or Modify Tools
- T1070.004 File Deletion
- T1040 Network Sniffing
- T1572 Protocol Tunneling
- T1071.001 Web Protocols
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Cl0p PTC Windchill/FlexPLM CVE-2026-12569 WSDL Recon, X-windchill-req And JSP Webshell Access** (`TL-2026-5637-SPL-001`)

Behaviour-first detection of Cl0p exploitation of PTC Windchill PDMLink/FlexPLM (CVE-2026-12569, CISA KEV, CWE-502): GET /Windchill/rfa/jsp/login/*.jsp?wsdl reconnaissance, a malicious X-windchill-req header, requests to hex-named JSP webshells under /Windchill/login/, and traffic from Ransom-ISAC listed Cl0p IPs. Catches the pre-auth chain before double-extortion data staging.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1505.003
- **Data sources:** web_access_logs, iis, apache_access, stream_http
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web (sourcetype=access_combined OR sourcetype=iis OR sourcetype="stream:http" OR sourcetype=apache:access) "Windchill" earliest=-24h
| eval src=coalesce(src_ip, clientip, c_ip), uri=coalesce(uri_path, cs_uri_stem, uri), qs=coalesce(uri_query, cs_uri_query, "")
| eval wsdl_recon=if(match(uri,"(?i)/Windchill/rfa/jsp/login/[^/]*[.]jsp") AND match(qs,"(?i)wsdl"),1,0)
| eval hdr_hit=if(match(_raw,"(?i)X-windchill-req"),1,0)
| eval webshell_req=if(match(uri,"(?i)^/Windchill/login/[0-9a-f]{6,}[.]jsp$"),1,0)
| eval known_ip=if(in(src,"216.152.148.54","216.152.151.204","104.243.35.63","5.180.41.35","79.141.160.78"),1,0)
| where wsdl_recon=1 OR hdr_hit=1 OR webshell_req=1 OR known_ip=1
| stats count as hits min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(status) as http_status max(wsdl_recon) as wsdl_recon max(hdr_hit) as xwindchill_req_header max(webshell_req) as webshell_request max(known_ip) as cl0p_known_ip by src, host
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table first_seen last_seen host src hits uris http_status wsdl_recon xwindchill_req_header webshell_request cl0p_known_ip
```

### Microsoft KQL

```kql
let cl0p_ips = dynamic(["216.152.148.54","216.152.151.204","104.243.35.63","5.180.41.35","79.141.160.78"]);
W3CIISLog
| where TimeGenerated > ago(24h)
| where csUriStem has "/Windchill/"
| extend wsdl_recon = csUriStem matches regex @"(?i)/Windchill/rfa/jsp/login/[^/]*[.]jsp" and csUriQuery has "wsdl"
| extend webshell_req = csUriStem matches regex @"(?i)^/Windchill/login/[0-9a-f]{6,}[.]jsp$"
| extend known_ip = cIP in (cl0p_ips)
| where wsdl_recon or webshell_req or known_ip
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Uris=make_set(csUriStem, 20), Statuses=make_set(scStatus, 10), WsdlRecon=max(wsdl_recon), WebshellReq=max(webshell_req), Cl0pIp=max(known_ip) by cIP, sSiteName, Computer
| project FirstSeen, LastSeen, Computer, sSiteName, cIP, Hits, Uris, Statuses, WsdlRecon, WebshellReq, Cl0pIp
```

### Sigma

```yaml
title: PTC Windchill FlexPLM WSDL Recon And Webshell Access - CVE-2026-12569
id: 3b0f6a52-8d1e-4c47-9a2b-5e7c1d9f4a10
status: experimental
description: Detects web requests tied to Cl0p exploitation of PTC Windchill/FlexPLM CVE-2026-12569 - WSDL reconnaissance against /Windchill/rfa/jsp/login/*.jsp, hex-named JSP webshell requests under /Windchill/login/, and requests from Ransom-ISAC listed Cl0p source IPs.
references:
    - https://ransom-isac.org/blog/clop-windchill-flexplm-exploitation/
    - https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-july-e89
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - cve.2026.12569
logsource:
    category: webserver
detection:
    selection_wsdl:
        cs-uri-stem|re: '(?i)/Windchill/rfa/jsp/login/[^/]*[.]jsp'
        cs-uri-query|contains: 'wsdl'
    selection_shell:
        cs-uri-stem|re: '(?i)^/Windchill/login/[0-9a-f]{6,}[.]jsp$'
    selection_ip:
        c-ip:
            - '216.152.148.54'
            - '216.152.151.204'
            - '104.243.35.63'
            - '5.180.41.35'
            - '79.141.160.78'
        cs-uri-stem|contains: '/Windchill'
    condition: 1 of selection_*
falsepositives:
    - Authorised vulnerability scanners probing the FlexPLM WSDL endpoint
    - 104.243.35.0/24 is shared hosting; validate before blocking
level: high

```

**Known false positives:**

- Authorised vulnerability scanners or asset-discovery tools requesting the FlexPLM WSDL endpoint
- 104.243.35.63 sits in shared hosting (104.243.35.0/24); legitimate tenants may appear
- Internal PTC support tooling requesting login JSPs with a WSDL query

**Tuning notes:** Tune the sourcetype list and field aliases (uri_path/cs_uri_stem, src_ip/c_ip) to the Windchill front-end in use. The X-windchill-req header is only matched when the web tier logs raw headers (stream:http, WAF or a custom log format); otherwise rely on the WSDL, webshell-path and IP branches. Exclude approved scanner addresses via a NOT src filter. Treat any 200 response on a hex-named /Windchill/login/ JSP as a confirmed webshell. Patch to releases from PTC advisory CS473270.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SonicWall SMA 1000 UTA0533 /wsproxy Tunnel Exploitation (CVE-2026-15409/CVE-2026-15410) (locked: unlock with TL Creds)
- HelloNet ViPNet [indicator] [indicator] Sideload And UAC-0099 [indicator] Masquerade (locked: unlock with TL Creds)
- msaRAT Headless Browser CDP Control With Workers.dev WebRTC Signaling (locked: unlock with TL Creds)
- cPanel/WHM Pre-Disclosure Login Probing (CVE-2026-41940, [indicator]) (locked: unlock with TL Creds)
- SonicWall SMA 1000 Post-Exploitation - ROOTRUN xzfind, KNUCKLEBALL, Suo5 And ORANGETAIL (locked: unlock with TL Creds)
- C2 Domain Resolution - [indicator] And ols-img-12.workers.dev (locked: unlock with TL Creds)
- Cl0p Windchill Post-Exploitation - Hex-Named JSP Webshell And flst.txt Written (locked: unlock with TL Creds)
- C2 And Staging Infrastructure Contacts - Cl0p, UTA0533, HelloNet, VShell/Hades, msaRAT, PatchAgent (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 32)

Defanged, TLP:CLEAR.

- IP address: `43.246.208[.]207`
- Domain: `redhatupdating432[.]dnsrd[.]com`
- File hash: `81a9af3846bad3a1107164ff7cf0a08e020b31a3b32fd17866e17d4c1565f7f2`

Full set of 32 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CTO at NCSC Summary: week ending July 26th](https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-july-e89)
- [Ransom-ISAC: Cl0p Windchill/FlexPLM exploitation](https://ransom-isac.org/blog/clop-windchill-flexplm-exploitation/)
- [Volexity: Proxying to Compromise SonicWall Secure Mobile Access 0-day exploitation](https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/)
- [NCSC: UK and partners expose Russian state-supported actors for new zero-click phishing campaign](https://www.ncsc.gov.uk/news/uk-and-partners-expose-russian-state-supported-actors-for-new-zero-click-phishing-campaign)
- [CISA Advisory AA26-097A (Iranian-affiliated actors exploiting PLCs)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a)
- [Talos: Chaos msaRAT living off the browser](https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/)
- [Hunt.io: Thailand Ministry of Finance targeted with Hermes AI agent](https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent)
- [Hunt.io: Open directory NGINX Rift / Ghost CMS multi-CVE](https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve)
- [Securelist: HelloNet / ViPNet](https://securelist.com/tr/hellonet-vipnet/120700/)
- [Group-IB: JadeProx / TriBack Loader](https://www.group-ib.com/blog/jadeprox-china-nexus-triback-loader/)
- [Ransom-ISAC: MuddyWater ClickFix / PatchAgent](https://ransom-isac.org/blog/muddywater-clickfix-patchagent/)
- [Honeylabs: Probe 17 days before the CVE (cPanel/WHM CVE-2026-41940)](https://honeylabs.net/blog/probe-17-days-before-the-cve)
- [CERT-UA: UAC-0099 report](https://cert.gov.ua/article/6318634)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5637