Major Manufacturing Software Targeted by Clop Ransomware Gang in New Data Extortion Campaign

A New Attack on Manufacturing Tools

Cybercriminals operating the Clop ransomware operation have begun targeting two widely-used software platforms designed for product development and manufacturing planning. The attackers are exploiting security weaknesses in these systems to break in, steal sensitive company data, and then lock files until victims pay ransom demands.

The targeted applications—Windchill and FlexPLM—are enterprise-level tools that companies rely on to manage product designs, manufacturing schedules, and intellectual property. Thousands of organizations across industries like automotive, aerospace, and electronics depend on these platforms daily. When attackers successfully penetrate these systems, they gain access to blueprints, trade secrets, and confidential business information that could be worth millions of dollars.

Understanding the Attack Method

Think of ransomware attacks like breaking into a filing cabinet, photographing all the important documents, then locking the cabinet and demanding payment to unlock it. The attacker benefits twice—once by selling the stolen information, and again by extorting the company to restore access to their systems.

In this case, the Clop gang is using unpatched vulnerabilities—security flaws that exist in older versions of these software products. When companies fail to apply security updates promptly, they leave digital doors unlocked. The attackers simply walk through these doors, establish hidden access points, and prepare their ransomware deployment.

What This Means

This development signals that criminal organizations are becoming more sophisticated in targeting specific industries. Rather than launching broad attacks hoping to catch anyone, they're now focusing on tools used by manufacturers and engineering firms. This approach is more profitable because:

• Manufacturing companies typically have substantial budgets and can afford ransom payments
• The stolen data—product designs and manufacturing processes—carries enormous value on black markets
• Companies face intense pressure to restore operations quickly to avoid production shutdowns
• Business interruption costs often exceed ransom amounts, making payment seem reasonable

Why You Should Care

If your company uses these platforms, you face direct risk. If you work in manufacturing, aerospace, automotive, or electronics industries—even if you're not an IT professional—your employer's data security directly affects job security and company stability. A successful ransomware attack can force layoffs, facility closures, and financial crisis.

The real danger extends beyond ransom payments. Stolen design data can be leaked publicly, giving competitors access to proprietary innovations that took years and millions to develop.

Even small suppliers to major manufacturers are at risk. If your company provides parts or services to larger manufacturers using these vulnerable platforms, a breach upstream could cascade to your business through compromised supply chain relationships.

What You Can Do

If you manage IT systems or work in your company's technology department, take these steps immediately:

• Check whether your organization uses Windchill or FlexPLM—inventory all versions currently running
• Install all available security patches from the vendor without delay
• Review system access logs for suspicious login activity or unauthorized access
• Ensure backup systems are isolated and cannot be accessed through your main network
• Strengthen password requirements and enable multi-factor authentication
• Conduct security awareness training emphasizing phishing emails and social engineering

For all employees: report anything suspicious—unexpected system slowdowns, unusual file access requests, or strange emails—to your IT security team immediately.

Manufacturing companies must treat software security updates as critical business operations rather than optional maintenance.