Kiteworks warns customers to shut down servers due to possible imminent attack

Kiteworks is recommending customers shut down their servers starting tonight due to a potential imminent threat, citing a warning from law enforcement officials.

In emails to customers, first reported on by German news site Heise Online, the security software company specified a six-hour window for servers to be shuttered as the company and law enforcement investigate.

“Kiteworks received credible threat intelligence from law enforcement indicating that a threat actor may attempt to target some Kiteworks systems for customers. Out of an abundance of caution, we notified customers directly and recommended a precautionary shutdown window while we and our law enforcement partners work through the matter,” Kiteworks CISO Frank Balonis said in a statement provided to SC Media.

The recommended shutdown window is said to be between 4 a.m. and 10 a.m. Saturday in Central Europe, according to Heise, or 10 p.m. Friday to 4 a.m. Saturday on the United States East Coast.

Jake Knott, head of threat intelligence at watchTowr, told SC Media, “suggesting a customer shut down their servers is both unusual and never a good sign, especially when the remediation is the power button. There is no known CVE, patch, or additional technical detail available — but nobody requests that their entire customer base […] unplug production system over the weekend because of a hunch.”

Related reading:

Balonis stated that there is no known compromise of Kiteworks’ own systems and that all known vulnerabilities are addressed in the current release, 9.5.1, calling the advisory “preventative rather than a response to a confirmed breach.”

Heise’s report states that Kiteworks’ customer support cited “potential zero-day attacks” as a reason for asking customers to shut down their servers; Heise also reports that Kiteworks said even servers that are not accessible from the internet should be shut down.

“If the company is saying ‘shut it down’ even if it’s not exposed, then you have to assume the Zero-Day is something already running on the system and has a C2 channel waiting for a command to ‘execute,’” commented Zero Networks Chief AI Security and Customer Officer Nick DiCola, in an email to SC Media.

While the exact nature of the potential threat has not been confirmed, Knott noted that Kiteworks, formerly known as Accellion, has previously had its file transfer application targeted by ransomware gangs, and that managed file transfer (MFT) systems in general remain an attractive target for cybercriminals.

“Vulnerabilities impacting MFT appliances rarely remain a secret for long, and typically rapidly accelerate from targeted exploitation to indiscriminate, in-the-wild exploitation, with both researchers and attackers likely already throwing the codebase through their favorite LLMs,” Knott said.

SC Media reached out to the US Department of Justice and Federal Bureau of Investigation for this story. An FBI spokesperson said the bureau declined to comment.