Researchers have identified a custom web shell linked to the Clop ransomware gang, specifically designed to target PTC Windchill and FlexPLM servers. This malicious tool includes features that allow attackers to decrypt stored credentials, scan file repositories, and exfiltrate sensitive files. The web shell poses a significant risk to organizations using these platforms, as it enables cybercriminals to gain unauthorized access to critical data. Companies using Windchill and FlexPLM need to be vigilant and take steps to secure their systems against this specific threat. The incident underscores the ongoing challenges organizations face in protecting their data from sophisticated ransomware attacks.