Clop Ransomware Targets Product Lifecycle Management Software

A fresh wave of extortion attacks is underway, and this time the Clop ransomware group (also tracked as Cl0p) has set its sights on product lifecycle management (PLM) platforms. Security researchers have identified active exploitation of internet-exposed PTC Windchill and FlexPLM systems, the software many manufacturers and product design teams rely on to manage engineering data, documents, and workflows across a product's entire lifecycle.

The attackers are leveraging CVE-2026-12569, a critical unauthenticated remote code execution vulnerability with a CVSS score in the 9.3 to 9.8 range. The flaw stems from unsafe deserialization, a common but dangerous coding pattern that lets malicious input be interpreted as executable commands rather than harmless data. Because the vulnerability requires no authentication, any exposed Windchill or FlexPLM instance reachable from the public internet is a potential entry point. Security firms including ReliaQuest have flagged the activity as part of Clop's established playbook: steal sensitive data first, then use the threat of public disclosure to pressure victims into paying.

This pattern should feel familiar. Clop has built its reputation on hitting file transfer and enterprise software platforms rather than deploying traditional file-encrypting ransomware, preferring data theft and extortion instead. Organizations running Windchill or FlexPLM, particularly those with instances accessible from outside their internal network, should treat this as an urgent patching and exposure-review priority.

Hotel Wi-Fi Hijacks Are Quietly Stealing Microsoft 365 Logins

Alongside the PLM extortion campaign, researchers are also tracking a separate and troubling trend: attackers hijacking hotel Wi-Fi networks to intercept Microsoft 365 credentials. Business travelers connecting to compromised hotel guest networks can be silently redirected toward fraudulent login pages designed to look like legitimate Microsoft sign-in portals. Once a traveler enters their username and password, the credentials go straight to the attacker.

Hotel and travel-adjacent infrastructure has become an increasingly attractive target for credential theft and data exposure more broadly. It echoes concerns raised by the Reqrea hotel check-in breach that exposed over a million passports, where a misconfigured cloud storage bucket left sensitive identity documents accessible for what may have been years. Whether it's a poorly secured guest Wi-Fi gateway or an unlocked cloud bucket, hospitality technology continues to be a soft spot in the broader security chain, and travelers are often the ones left exposed.

For anyone who regularly logs into corporate accounts while traveling, this is a reminder that hotel networks should never be treated as trusted infrastructure, no matter how official the login screen looks.

Certighost Domain Takeovers and FastJson RCE Round Out the Threat Landscape

Rounding out this cluster of active threats, researchers have also flagged Certighost-related domain takeover activity and ongoing exploitation tied to FastJson remote code execution vulnerabilities. Domain takeovers can allow attackers to hijack legitimate web properties or subdomains, often to host phishing pages or malware with an air of borrowed credibility. FastJson, a widely used Java library for parsing JSON data, has a long history of deserialization vulnerabilities that attackers continue to weaponize against unpatched systems.

Taken together, these four threads, PLM extortion, hotel Wi-Fi credential theft, domain takeovers, and library-level RCE bugs, illustrate just how varied the current attack surface has become. Attackers are exploiting everything from enterprise software deserialization flaws to the Wi-Fi router in a hotel lobby.

What This Means For You

Most readers won't be running PTC Windchill or FastJson directly, but the underlying lessons apply broadly. If your organization uses PLM software, engineering data management tools, or any internet-facing enterprise platform, confirm with IT whether it's exposed to the public internet and whether patches for known vulnerabilities have been applied. If you travel for work and rely on Microsoft 365 or similar cloud services, be cautious about which networks you trust and how you authenticate while away from your home or office network.

The common thread across all of these incidents is exposure: exposed servers, exposed networks, exposed credentials. Reducing that exposure, whether through patching, network segmentation, or safer connection habits while traveling, remains the most reliable defense against opportunistic attackers.

Actionable Takeaways

  • If your organization runs PTC Windchill or FlexPLM, prioritize patching CVE-2026-12569 and verify these systems aren't unnecessarily exposed to the internet.
  • Avoid entering Microsoft 365 or other corporate credentials over hotel or public Wi-Fi; use a trusted VPN or your organization's approved remote access tools instead.
  • Double-check login URLs manually rather than clicking links, especially on unfamiliar networks, to avoid landing on spoofed authentication pages.
  • Keep an eye on security advisories related to FastJson and unsafe deserialization if your organization uses Java-based applications.

This Clop ransomware campaign against PLM systems is a reminder that extortion groups will target whatever software holds valuable data, whether it's a file transfer tool or a product design platform. Staying current on patches and limiting internet exposure remain the most effective ways to stay off their radar.