A series of prominent organisations including UK fossil fuel giant Shell, Dutch consumer and health tech multinational Philips, and the US\u2019 General Electric (GE), are probing security breaches after being \u2018named and shamed\u2019 by the Cl0p\/Clop cyber extortion gang.<\/p>\n
Cl0p, which has a long history of targeting blue chip firms by compromising commonly used enterprise platforms, named all three organisations among close to 50 others in an update to its dark web leak site.<\/p>\n
All of the victims appear to have been compromised via a critical zero-day flaw in PTC\u2019s Windchill PDMLink and FlexPLM product lifecycle management software packages, tracked as CVE-2026-12569.<\/p>\n
Identified and patched in June and added to Cisa\u2019s Known Exploited Vulnerabilities (Kev) catalogue shortly thereafter, the flaw becomes exploitable by chaining a pre-authentication information disclosure issue in the FlexPLM WSDL endpoint with a server-side issue in Windchill\u2019s login servlet.<\/p>\n
Ultimately, according to members of the Ransom-ISAC anti-ransomware community, these conditions enabled the threat actors to deploy webshells, achieve unauthenticated remote code execution (RCE), and exfiltrate their victims\u2019 data.<\/p>\n
Ransom-ISAC\u2019s Brandon Parsons wrote that Cl0p\u2019s campaign seems to have begun on or around 20 July, when the gang starting emailing multiple users at the affected organisations from randomly compromised accounts.<\/p>\n
Parsons observed: \u201cThis extortion approach is consistent with what we observed with the Oracle EBS campaign last year, except for the use of new email addresses.\u201d<\/p>\n
In statements shared with the media, Shell, Philips and GE all confirmed they were in the process of investigating the claims, but none of them named the Cl0p operation specifically.<\/p>\n
Shell told Reuters it was \u201cworking with security teams and relevant experts\u201d on its investigation, while GE said it had \u201cinitiated our cyber response protocols and are working to assess the potential issue\u201d.<\/p>\n
A spokesperson for Philips went further, saying: \u201cPhilips has identified and contained an attempted cyber security compromise of a specific enterprise server related to internal data.\u201d<\/p>\n
According to Cl0p\u2019s unverified claims, the gang has stolen 89GB of data from Shell, 15.5GB from Philips, and 391GB from GE. In Shell\u2019s case this information allegedly includes engineering drawings, photos of oil facilities, scans of test projects and other project plans.<\/p>\n
As Ransom-ISAC\u2019s analysts observed, Cl0p\u2019s activity in this latest wave of breaches strongly echoes previous campaigns conducted by the gang, targeting the likes of Acellion, Oracle, and perhaps most famously Progress Software.<\/p>\n
Three years on from its infamous attack on Progress\u2019 MOVEit file transfer tool, which hit thousands of companies, Cl0p still cleaves to its simple and highly effective \u2018business\u2019 model, foregoing traditional encryption ransomware in favour of compromising widely-used software products to target multiple downstream customers, stealing their data, and exposing it if not paid.<\/p>\n
CybaVerse chief technology officer (CTO) Simon Phillips said the developing incident had the potential to be another huge data breach along the lines of Cl0p's previous attacks.<\/p>\n
\u201cGiven Cl0p\u2019s reputation of launching mass attacks, all organisations showing on the leak site must take steps to investigate these claims. They must monitor for unauthorised access and identify if any data has been exfiltrated from their systems,\u201d he said.<\/p>\n