Criminal Gang Shifts Strategy, Directly Attacking Manufacturing Software Without User Passwords

A New Threat Emerges in Corporate Software

For years, cybercriminals followed a predictable pattern when targeting businesses. They would send convincing emails to employees, trick them into revealing usernames and passwords, then patiently wait for the right moment to break in. The approach was indirect but effective.

That old playbook is becoming obsolete. Security researchers have discovered that members of the Cl0p criminal group are now attacking manufacturing companies through a completely different method. Instead of waiting for stolen credentials, they are directly infiltrating specialized engineering software that manages product design and planning. The software in question—PTC Windchill and FlexPLM—are industry-standard tools used by factories and manufacturers worldwide to organize blueprints, designs, and production schedules.

The attack works because these software systems, when connected directly to the internet without proper protection, contain security weaknesses that allow hackers to execute commands remotely. Think of it like finding a back door to a factory floor that requires no key—anyone who knows it exists can walk straight in.

What This Means

This shift represents a fundamental change in how professional criminals operate. Rather than playing a waiting game with stolen passwords, they are now hunting for exposed corporate software and breaking in immediately through technical vulnerabilities. This approach is faster, more direct, and harder to detect because it leaves no trail of suspicious login attempts.

For manufacturing companies, this is particularly dangerous because tools like Windchill and FlexPLM control sensitive information: product designs, manufacturing instructions, supply chain details, and timelines. Unauthorized access could allow competitors to steal intellectual property or give criminals the ability to disrupt production entirely.

The shift from credential-stealing to direct software attacks shows criminals are becoming more technically sophisticated and patient defenses are no longer enough.

Why You Should Care

If you work in manufacturing, engineering, or any industry using these specialized tools, this threat directly affects your company's security. Even if you don't use PTC software specifically, the principle applies broadly: any business software exposed to the internet without strong protection is at risk.

Beyond the workplace, this matters because manufacturing disruptions have ripple effects. A compromised factory might delay car production, pharmaceutical manufacturing, or consumer goods. Supply chain disruptions hurt prices and availability for everyone.

Additionally, stolen product designs can mean lost competitive advantages and millions in lost revenue for companies that invest years in development.

What You Can Do

• If you manage these systems: Check whether your Windchill or FlexPLM installation is directly accessible from the internet. It should be protected behind firewalls and require authentication at every layer.
• Apply security patches immediately: Software vendors release updates specifically to close the vulnerabilities these attackers exploit. Delayed patching is an open invitation.
• Use multi-factor authentication: Even if criminals do obtain a password, a second verification step can stop them.
• Monitor access logs: Watch for suspicious login patterns or commands that shouldn't be happening.
• Segment your network: Keep sensitive engineering tools isolated from general internet access whenever possible.

The days of assuming your corporate software is safe just because it runs behind a company network are over; assume every internet-facing system needs active defense.