What We Know
Security researchers have identified a custom Java web shell that was designed to operate against PTC Windchill and is likely linked to the Clop ransomware group.1Backed by 1 sourcesBleepingComputer
Multiple security teams say the web shell appears in the context of Clop’s broader mass‑extortion activity, prompting vendors and defenders to publish detection guidance and instrument Windchill telemetry to spot the custom implant and related access patterns.1Backed by 1 sourcesSecuronix
Source Comparison
Aligned reporting1 corroborates - 1 adds context - 0 conflicts