Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

Published on July 25, 2026

Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. "Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling

Continue reading on website
Other news

DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts

July 25, 2026
The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims.Swiss cybersecurity company PRODAFT is tracking the centrally administered RaaS operation under the name Funky Mantis."The portal combined build generation, finance,

CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking

July 25, 2026
For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an opportunity arose.That model is changing.Recent investigations into insurance-focused phishing operations reveal a more immediate approach. Instead of harvesting