Introduction
Kiteworks, a secure file-sharing software company, has urged its worldwide customers to temporarily shut down their servers for a six-hour period. This recommendation comes after the company received threat intelligence indicating a potential imminent cyberattack targeting its systems.
Threat Intelligence and Recommendation
According to German technology publication Heise, Kiteworks CISO Frank Balonis sent an email to customers warning them about the imminent threat. The email stated that credible threat intelligence from law enforcement indicated an attack on Kiteworks systems may be imminent this weekend. Kiteworks recommended that customers shut down their Kiteworks systems for six hours as a precautionary measure.
Shutdown Window and Time Zones
The shutdown window applies to customers worldwide, with affected time zones ranging from Australian Eastern Standard Time (AEST) to Pacific Daylight Time (PDT). In Central Europe, customers were instructed to shut down Kiteworks systems between 4:00 a.m. and 10:00 a.m. on Saturday, September 26. In New York, the shutdown window would be from 10:00 p.m. Friday to 4:00 a.m. Saturday.
Recommendations and Actions
Kiteworks recommends that customers shut down the servers before the scheduled window and take systems offline even if they are not directly accessible from the Internet. The company confirmed the warning to BleepingComputer, stating it received intelligence from federal authorities that a threat actor may attempt to target some customer systems. The company advises that the shutdown is precautionary rather than a response to a confirmed breach, as it is not aware of any compromise of Kiteworks systems.
Potential Zero-Day Attacks
While Kiteworks has not confirmed that attackers are exploiting an unknown vulnerability, Heise reports that the shutdown recommendation is intended to protect customers against potential zero-day attacks. The company describes the shutdown as a precaution based on intelligence received from authorities, emphasizing that all known vulnerabilities are fixed in version 9.5.1.
Context and Background
Kiteworks develops secure file-transfer and communications products used by government organizations, financial institutions, and enterprises. Secure file-sharing platforms commonly store sensitive documents, making them valuable targets for cybercriminals who conduct data-theft extortion attacks. The Clop extortion gang has a history of targeting enterprise platforms in data-theft attacks, including Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer. The U.S. Department of State now offers a $10 million reward for any information linking the cybercrime gang's attacks to a foreign government.
Additional Security Measures
Kiteworks has also addressed a critical flaw and is now bringing customer systems online. Microsoft has shared how to fix broken Exchange Online EWS apps. OpenAI's new GPT-6 Cyber AI has discovered 81 Firefox flaws and 948 Linux bugs. QNAP has reported that hackers are breaching NAS devices in Plex2Shell attacks. SonicWall warns of a new SSL-VPN MFA bypass flaw exploited in attacks. Your carrier tracks you. We don’t. Switch to Cape, America’s Privacy-first Mobile Carrier. Your employees already connected AI to Gmail and Drive. Find out what it can read in the Workspace Risk Index. Your carrier tracks you. We don’t. Switch to Cape, America’s Privacy-first Mobile Carrier.
Conclusion
Kiteworks' recommendation to shut down servers for six hours is a precautionary measure to protect against potential cyberattacks. The company emphasizes that all known vulnerabilities are addressed in their current release, 9.5.1, and the shutdown is based on intelligence from authorities. As cyber threats continue to evolve, companies like Kiteworks are taking proactive measures to safeguard their customers' systems and data.