Clop created custom web shell for Windchill data theft attacks
A custom Java web shell linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files.
Intelligence analysis by Llama
Clop ransomware gang created a custom web shell for Windchill and FlexPLM servers, allowing them to decrypt credentials, enumerate file repositories, and steal files. The web shell was designed to target Windchill servers and uses Windchill's own functions to access its database.
Imagine a special tool that hackers use to break into a company's computer system. This tool is like a super-powerful key that can unlock the system and let the hackers in. The hackers can then use the system to steal important information and cause trouble. The tool is called a web shell, and it's like a backdoor that lets the hackers in without being detected.
Analysis
Custom Web Shell Design for Windchill Servers
The Clop ransomware gang has been linked to a custom Java web shell designed specifically for PTC Windchill and FlexPLM servers. This web shell was created to target Windchill servers and uses Windchill's own functions to access its database. The web shell is a JavaServer Pages (JSP) web shell that directly imports Windchill-specific classes, including MethodContext, WTConnection, and WTKeyStoreUtil. These classes allow the shell to use Windchill's own functions to access its database, decrypt stored credentials, and locate files stored in application vaults.
The web shell connects to Windchill's database through the application's own MethodContext and WTConnection classes, meaning its queries run under the application's existing database identity rather than through a separately configured attacker account. This makes it difficult to detect the activity using traditional database telemetry methods.
Commands Supported by the Clop Windchill Web Shell
The web shell supports several commands, including S, L, D, G, R, J, O, and E. These commands allow the attackers to steal Windchill secrets and configuration, map Windchill's file vault, enumerate directories and retrieve files, read a file, delete a file, load and execute additional Java code, identify the operating system, and echo supplied data.
Implications of the Custom Web Shell
The creation of a custom web shell for Windchill servers highlights the sophistication of the Clop ransomware gang and their ability to create targeted attacks. It also emphasizes the importance of patching vulnerable systems and changing credentials to prevent data theft attacks. Organizations should immediately patch vulnerable Windchill systems and look for unusual JSP files in Windchill directories, especially those containing reference to X-windchill-req. They should also change the LDAP manager password and other Windchill credentials, as they should be considered compromised.
Key points
- Clop ransomware gang created a custom web shell for Windchill and FlexPLM servers.
- The web shell uses Windchill's own functions to access its database and decrypt stored credentials.
- The web shell supports several commands, including S, L, D, G, R, J, O, and E.
- Organizations should immediately patch vulnerable Windchill systems and change their credentials to prevent data theft attacks.
If organizations patch their vulnerable Windchill systems and change their credentials, they can prevent data theft attacks and protect their sensitive information. This is a positive step towards securing their systems and preventing future attacks.
If organizations fail to patch their vulnerable Windchill systems and change their credentials, they risk being compromised by the Clop ransomware gang and losing sensitive information. This is a realistic downside risk that organizations should be aware of and take steps to mitigate.
