Clop (Cl0p) Targets PTC Windchill & FlexPLM in Large-Scale Data-Theft Campaign
The Clop ransomware group (also tracked as Cl0p) is actively exploiting internet-exposed PTC Windchill and FlexPLM product lifecycle management (PLM) systems in a data-theft and extortion campaign. Attackers are leveraging CVE-2026-12569, a critical unauthenticated remote code execution vulnerability (CVSS ~9.3–9.8) involving unsafe deserialization.
ReliaQuest and Ransom-ISAC observed JSP webshell deployment, filesystem enumeration, and exfiltration of sensitive engineering/design data. Extortion emails (often from compromised accounts) have been sent to employees of affected organizations, claiming a “Windchill PDMLink module serious data leak.” The flaw was reportedly used as a zero-day earlier in June; CISA has highlighted related exploitation.
PLM platforms hold high-value intellectual property in manufacturing, aerospace, and defense supply chains, making the impact severe. Organizations should immediately apply PTC’s security update (CS473270 or equivalent), restrict external access behind VPN/zero-trust gateways, hunt for the reported webshell indicators (including custom headers such as X-windchill-req), and monitor for anomalous LDAP/credential harvesting.
Hotel & Conference Wi-Fi DNS Poisoning Steals Microsoft 365 Accounts
Threat actors are compromising captive-portal Wi-Fi gateways at hotels and conference centers to poison DNS and redirect travelers to fake Microsoft 365 login pages—no phishing email or endpoint malware required. ReliaQuest identified affected gateways across multiple U.S. cities plus India and Saudi Arabia; activity has been ongoing since at least June 2026.
Attackers gain admin access via exposed management interfaces (SSH, SNMP, web consoles) and weak credentials, then alter DNS so legitimate Microsoft domains resolve to attacker infrastructure (domains such as m365-owa[.]com, owa-ms365[.]com, etc.). Some flows abuse device-code OAuth to obtain valid tokens and bypass MFA. The tradecraft echoes prior APT28-linked router campaigns.
Traveling employees in finance, healthcare, legal, energy, and professional services are primary targets. Defenses include always-on full-tunnel VPN, encrypted DNS in strict mode, disabling WPAD and unnecessary device-code authentication in Entra ID, and reviewing gateway logs for configuration changes.
Certighost PoC Released: Low-Privileged AD Users Can Impersonate Domain Controllers
Researchers publicly released a working proof-of-concept (and technical details) on July 24 for “Certighost” (CVE-2026-54121), an Active Directory Certificate Services (AD CS) vulnerability patched by Microsoft in the July 14, 2026 updates.
A low-privileged domain user can abuse the CA’s “chase” enrollment fallback, stand up rogue listeners, and obtain a certificate that impersonates a Domain Controller. With DC privileges the attacker can perform DCSync, extract the krbtgt hash, and achieve full domain compromise (Golden Ticket territory). The PoC chains machine-account creation (via default ms-DS-MachineAccountQuota) with the flawed chase path.
Any environment still running unpatched Enterprise CAs on Windows Server 2012–2025 is at elevated risk now that a public exploit exists. Prioritize the July Microsoft updates, audit AD CS enrollment permissions and certificate templates, and validate that chase targets are restricted to genuine DC objects.
Critical FastJson RCE (CVE-2026-16723) Under Active Exploitation – No 1.x Patch
A critical remote-code-execution vulnerability in Alibaba’s FastJson library (versions 1.2.68–1.2.83) is being actively targeted. Tracked as CVE-2026-16723 (CVSS 9.0), it requires no AutoType enablement and no third-party gadget chain—exploitation works under default configurations, especially in Spring Boot fat-JAR deployments.
FastJson 1.x is end-of-life; no patched 1.x release exists. Attackers can achieve unauthenticated RCE simply by sending crafted JSON. Finance and healthcare organizations have been noted among those affected.
Immediate mitigations: enable SafeMode (-Dfastjson.parser.safeMode=true or equivalent), migrate to FastJson2 (unaffected), or restrict network access to any service that deserializes untrusted JSON with the vulnerable library.
These four stories highlight persistent themes: internet-exposed enterprise applications, supply-chain/identity attack surfaces, and the rapid weaponization of both new and recently patched flaws. Patch aggressively, reduce exposure of management interfaces and PLM systems, enforce strong network and identity controls for travelers, and treat certificate services and legacy Java libraries as high-priority risk areas.