Weaponized 7z Archive Smuggling a Malicious Payload — Clop's Mass-Extortion Delivery Pattern (CVE-2026-12569 / PTC Windchill)

Clop (CL0P) ransomware's signature mass-extortion playbook for the PTC Windchill/FlexPLM campaign (CVE-2026-12569, CVSS 9.8, KEV-listed June 25) weaponizes archives in phishing emails: password-protected or plain compressed containers hide the real payload from single-pass gateway filters, and the malware only materializes when the victim opens the archive and executes the file inside — the same delivery pattern the gang has used since its 2023 file-transfer exploits. The campaign extorted 43+ organizations (Shell, Philips, GE, Fiserv) and Clop claims 89 GB of Shell engineering data. This demo reproduces the container-smuggling pattern safely: malicious-archive.7z packages a payload file whose content carries the standard EICAR test signature (a benign stand-in for real malware), plus a clean-archive.zip counterpart containing only harmless text. Nothing executes. MetaDefender's Archive Engine decodes and recursively unpacks the 7z at the gateway, feeds every extracted file to multi-engine scanning, and flags the malicious content before the payload can reach an endpoint — closing the container-obfuscation gap Clop relies on (user execution of a malicious file inside an archive, MITRE T1204.002).