Clop Hits Windchill and FlexPLM as Zimbra Zero-Click Abuse and AI-Scored Malware Lead July 24 Threats

Top Stories

Clop targets PTC Windchill and FlexPLM for data theft

Clop is reportedly targeting internet-exposed PTC Windchill and FlexPLM instances in a fresh extortion wave focused on data theft rather than immediate encryption, according to BleepingComputer (source).

Why it matters:
Windchill and FlexPLM are deeply embedded in engineering, product lifecycle management, and manufacturing workflows. If exposed externally, they can become a high-value path to IP theft, supplier records, design documents, and internal collaboration data.

What to do now: - Identify every externally reachable Windchill and FlexPLM instance. - Restrict internet exposure with VPN, reverse proxy access control, or IP allowlisting. - Review authentication logs, web server logs, and admin activity for anomalies. - Rotate credentials tied to those platforms if compromise is suspected. - Prepare for extortion-style incident response, including legal and communications workflows.

Dolphin X malware claims AI-assisted victim ranking

A new Dolphin X remote access trojan is being advertised with an AI-powered profiling capability that scores infected users to help threat actors prioritize high-value targets, per BleepingComputer (source).

Why it matters:
Even if the “AI” branding is partly marketing, the operational concept is important: automated triage of compromised hosts can accelerate hands-on-keyboard activity against executives, finance staff, developers, and admins.

What to do now: - Prioritize EDR detections on systems used by privileged users. - Alert on credential access, browser data theft, and rapid host profiling behavior. - Harden endpoint controls around script execution, LOLBins, and remote control tooling. - Reconfirm MFA coverage for email, VPN, cloud admin, and password vaults.

Origin Energy confirms customer data breach

Origin Energy said an unauthorized party accessed and leaked customer data online, exposing personally identifiable information, according to BleepingComputer (source).

Why it matters:
Utility and energy sector breaches create downstream phishing, identity fraud, and account takeover risk for customers and business partners. The operational issue is not only the breach itself but the follow-on abuse.

What to do now: - If you support affected customers or staff, warn them about targeted phishing and fake billing notices. - Increase scrutiny on helpdesk identity verification procedures. - Monitor for credential stuffing against customer portals. - Review DLP and customer-data access logging in comparable environments.

Fake Claude app via Bing ads delivers SectopRAT

BleepingComputer reports a malvertising campaign using Bing ads to push a fake Claude desktop app installer, hosted on a legitimate Claude.ai domain, to deliver SectopRAT malware (source).

Why it matters:
This is a strong reminder that: 1. Search ads remain a highly effective malware delivery channel. 2. Users often trust “official-looking” domains and AI tool branding. 3. Even legitimate hosting contexts can be abused in ways that bypass casual user scrutiny.

What to do now: - Block unsanctioned software downloads through DNS, proxy, or endpoint policy. - Warn users not to install AI desktop apps from ads. - Route common AI tool access through managed bookmarks or enterprise portals. - Hunt for recent installations of unexpected Electron-based or unsigned desktop apps.

Russian-linked actors exploit Zimbra zero-click flaw for email theft

CISA warned that the Russian state-sponsored group Laundry Bear, also tracked as Void Blizzard, has targeted Zimbra Collaboration servers using phishing plus a now-patched Zimbra vulnerability, according to BleepingComputer (source).

Why it matters:
Zimbra remains a recurring target in espionage and email theft operations. A zero-click or low-interaction path into mail systems dramatically increases risk because email holds both data and authentication flows.

What to do now: - Patch Zimbra immediately. - Review mailbox access, forwarding rules, delegated access, and suspicious sync behavior. - Audit admin logins and webmail sessions from unusual IP ranges. - Treat compromised mailboxes as a broader identity incident, not just a messaging incident.

Attackers abuse Notepad++ plugins for stealthy malware install

Ukraine’s CERT uncovered attacks that bundle legitimate Notepad++ with a malicious utility disguised as a plugin, according to BleepingComputer (source).

Why it matters:
This technique blends trusted software with malicious add-ons, making user suspicion and basic application allowlisting less effective. Developer and admin workstations are especially attractive targets for this pattern.

What to do now: - Audit Notepad++ plugin directories on managed systems. - Restrict plugin installation to approved sources and managed deployment. - Alert on unusual child processes launched by Notepad++. - Check for recent user-driven software sideloading outside approved channels.

Critical Vulnerabilities

CVE-2026-59555: Participants Database WordPress plugin arbitrary file deletion

• CVSS: 10.0
• Affected: Participants Database versions up to and including 2.7.8.3
• Summary: Unauthenticated arbitrary file deletion may allow attackers to remove critical files and disrupt site operation.
• Reference: Patchstack (source)

Defender action: - Update the plugin immediately if a fixed version is available. - If no patch is available, disable the plugin. - Review web root and application directories for missing or altered files. - Restore from known-good backups if deletion is confirmed.

CVE-2026-64812: JetBrains IntelliJ IDEA Remote Development unauthorized input injection

• CVSS: 10.0
• Affected: IntelliJ IDEA before 2026.2
• Summary: Unauthorized input injection was possible in a Remote Development session.
• Reference: JetBrains security fixes (source)

Defender action: - Update IntelliJ IDEA and related remote development components to 2026.2 or later. - Review exposed remote development environments and access paths. - Revalidate who can initiate and attach to remote sessions.

CVE-2026-64813: JetBrains IntelliJ IDEA Remote Development unauthorized settings modification

• CVSS: 10.0
• Affected: IntelliJ IDEA before 2026.2
• Summary: Unauthorized settings modification was possible in a Remote Development session.
• Reference: JetBrains security fixes (source)

Defender action: - Patch immediately alongside CVE-2026-64812. - Audit remote dev configuration drift and plugin settings changes. - Review developer workstation trust assumptions and remote host segmentation.

CVE-2026-14282: GoDAM WordPress plugin arbitrary file upload

• CVSS: 9.8
• Affected: GoDAM plugin versions up to and including 1.12.2
• Summary: Insufficient file type validation can enable unauthenticated arbitrary file upload, creating potential remote code execution risk.
• Reference: WordPress plugin code reference (source)

Defender action: - Update immediately or disable the plugin. - Search uploads directories for unexpected PHP or executable content. - Review recent form submissions and web server execution logs.

CVE-2026-15011: WordPress Customer Support Ticket System & Helpdesk code injection

• CVSS: 9.8
• Affected: Versions up to and including 6.0.5
• Summary: An attacker-controlled path parameter may permit unauthenticated invocation of arbitrary parameterless PHP functions when a public shortcode is exposed.
• Reference: WordPress plugin code reference (source)

Defender action: - Update or disable the plugin now. - Identify pages exposing the [emd_form] shortcode. - Inspect access logs for suspicious requests to plugin endpoints and crafted path values.

What Defenders Should Do Today

1. Hunt for exposed enterprise apps tied to extortion risk

Focus on: - PTC Windchill - FlexPLM - Zimbra - Remote development infrastructure - Public WordPress sites with high-risk plugins

Use external attack surface management, reverse proxy inventories, and certificate transparency data to verify exposure.

2. Patch high-risk software with external reach

Today’s priority patch queue should include: - Zimbra Collaboration servers - JetBrains IntelliJ IDEA before 2026.2 - WordPress plugins: Participants Database, GoDAM, Customer Support Ticket System & Helpdesk

If immediate patching is not possible: - remove public access, - disable vulnerable components, - add compensating WAF or reverse proxy controls, - increase log retention and alerting.

3. Tighten controls around software downloads and plugins

Recent stories show multiple trust-abuse patterns: - fake AI software installers, - malicious plugin sideloading, - abuse of legitimate apps and domains.

Apply: - browser isolation where available, - ad blocking or secure web gateway filtering, - application allowlisting, - software center-only install policies, - plugin governance for developer tools and editors.

4. Prepare for identity follow-on attacks after breaches

For organizations affected by energy-sector or customer-data incidents, expect: - spearphishing, - SIM swap attempts, - helpdesk impersonation, - credential stuffing.

Practical steps: - enforce phishing-resistant MFA for admins, - review customer support verification scripts, - monitor impossible-travel and suspicious login patterns, - alert users to likely impersonation lures.

Technical Deep Dive

Technical Notes: Quick checks for exposed Windchill, FlexPLM, and Zimbra assets

Start with asset discovery from approved internal inventories and internet-facing scans:

# Example: identify known hosts from internal DNS exports
grep -Ei 'windchill|flexplm|zimbra' dns_inventory.txt

# Example: test HTTPS headers for known applications
curl -Ik https://example-windchill.company.com
curl -Ik https://mail.company.com

For internal review, check reverse proxy and web access logs for unusual spikes, suspicious user agents, or requests from unfamiliar regions:

# Nginx examples
grep -Ei 'windchill|flexplm|zimbra' /var/log/nginx/access.log | tail -100
grep -Ei ' 40[134] | 50[0-9] ' /var/log/nginx/access.log | tail -100

Technical Notes: Web shell and malicious upload triage for WordPress

For the WordPress plugin issues, inspect uploads and plugin directories for executable content:

find /var/www/html/wp-content/uploads -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -print
find /var/www/html/wp-content/plugins -type f -mtime -7 -print

Look for suspicious requests in access logs:

grep -Ei 'wpforms|emd_form|path=|multipart/form-data' /var/log/apache2/access.log | tail -200
grep -Ei 'godam|wp-ticket|participants-database' /var/log/apache2/access.log | tail -200

Sample suspicious patterns:

POST /wp-admin/admin-ajax.php HTTP/1.1
POST /?wpforms_form_id=...
GET /.../includes/... ?path=phpinfo

Technical Notes: Notepad++ plugin abuse checks on Windows endpoints

Review common plugin paths on Windows systems:

$paths = @(
  "$env:ProgramFiles\Notepad++\plugins",
  "$env:AppData\Notepad++\plugins"
)
Get-ChildItem $paths -Recurse -ErrorAction SilentlyContinue |
  Select-Object FullName, Length, LastWriteTime

Check for recently dropped DLLs or unexpected executables:

Get-ChildItem "$env:ProgramFiles\Notepad++" -Recurse -Include *.dll,*.exe |
  Sort-Object LastWriteTime -Descending |
  Select-Object -First 50 FullName, LastWriteTime, Length

Useful process hunting logic: - Notepad++ spawning cmd.exe, powershell.exe, rundll32.exe, mshta.exe, or regsvr32.exe - New persistence entries shortly after a plugin install - User-profile plugin paths appearing on systems that normally use managed software deployment

Technical Notes: Zimbra mailbox compromise indicators

If you operate Zimbra, inspect: - newly created forwarding rules, - changes to delegated mailbox access, - unusual IMAP or webmail sessions, - admin actions outside maintenance windows.

Example triage questions: - Did mailbox forwarding suddenly increase? - Were there logins from rare ASNs or countries? - Did service accounts access user mailboxes unexpectedly?

So what should security teams prioritize first?

If resources are limited, this is the most practical order for July 24:

1. Patch or isolate Zimbra and exposed enterprise apps because compromise leads directly to data theft.
2. Disable or update vulnerable WordPress plugins because public exploitation paths are straightforward.
3. Block ad-driven and unsanctioned software installs to reduce malware ingress.
4. Inspect developer and admin endpoints for plugin abuse, RAT activity, and credential theft.
5. Prepare user communications where breach fallout may drive phishing and impersonation.

Bottom line

Today’s threat picture is dominated by three themes: exposed business-critical applications, trust abuse in software delivery, and rapid post-compromise prioritization by attackers. Clop’s focus on Windchill and FlexPLM, active concern around Zimbra exploitation, and multiple high-severity WordPress issues should push defenders toward immediate exposure reduction and patching. Add stronger controls for software installation and plugin use, and assume any recent customer-data incident will be followed by targeted social engineering.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.