A pre-auth information leak combined with unauthenticated RCE in PTC products lets Cl0p affiliates steal intellectual property.