Kiteworks, which provides secure file-transfer and communications software, has directed its customer base to perform an emergency shutdown of their servers across a six-hour window on Saturday in response to threat intelligence suggesting an imminent cyberattack.
According to German technology publication Heise, Kiteworks CISO Frank Balonis notified customers that the company had received "credible threat intelligence from law enforcement indicating an attack on Kiteworks systems may be imminent this weekend."
The shutdown directive spans multiple time zones globally. In Central Europe, the window runs from 4:00 a.m. to 10:00 a.m. on Saturday, September 26, while New York customers face a shutdown period from 10:00 p.m. Friday through 4:00 a.m. Saturday. The recommendation extends across regions from Australian Eastern Standard Time to Pacific Daylight Time.
Kiteworks advised customers to take systems offline before the scheduled window and emphasized that servers should be shut down regardless of whether they are directly exposed to the internet.
When contacted by BleepingComputer, Kiteworks confirmed the advisory, stating: "Kiteworks received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems for customers."
The company characterized the measure as precautionary rather than a response to an active compromise. "We are not aware of any compromise of Kiteworks systems, and this advisory is preventative rather than a response to a confirmed breach," Kiteworks said. The vendor added that "all known vulnerabilities are addressed in our current release, 9.5.1, and we continue to recommend customers run the latest version."
Zero-day speculation
While Kiteworks has not publicly acknowledged the existence of an unpatched vulnerability, Heise reported that company support staff indicated the shutdown is designed to mitigate potential zero-day exploits. "The reason we're asking you to shut down the servers is to protect against any potential zero-day attacks," Kiteworks support told Heise during verification of the warning.
Neither the official statement to BleepingComputer nor the customer communication cited by Heise explicitly confirms that a zero-day has been discovered or is currently under active exploitation. Kiteworks maintains that the precautionary measure stems from intelligence provided by authorities rather than confirmation of a specific vulnerability.
High-value target profile
Kiteworks serves government agencies, financial institutions, and large enterprises with its secure file-sharing platform. Such systems are attractive targets for threat actors conducting data-theft extortion campaigns because they typically house sensitive documents and intellectual property.
The Clop extortion gang has demonstrated a pattern of targeting enterprise file-transfer platforms in data-theft attacks, including Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer. The U.S. Department of State has posted a $10 million reward for information connecting the cybercrime group's operations to a foreign government.