Kiteworks Issues Emergency Shutdown Advisory Amid Federal Threat Warning
Kiteworks sent an urgent notice to its customers this week, advising them to temporarily shut down the company’s platform over a six-hour window on Saturday as a precautionary measure. The recommendation came after the company received credible threat intelligence from federal intelligence authorities indicating that a threat actor might attempt to target some Kiteworks systems.
Frank Balonis, Chief Information Security Officer at Kiteworks, confirmed the advisory in a statement to Recorded Future News, emphasizing that the action was taken out of an abundance of caution. He stated that the company is not aware of any confirmed compromise of its systems and described the shutdown as preventative, not a response to an active breach.
"We received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems for customers. Out of an abundance of caution, we notified customers directly and recommended a precautionary shutdown window while we and our law enforcement partners work through the matter."
— Frank Balonis, CISO, Kiteworks
Balonis added that all known vulnerabilities are addressed in the current release, version 9.5.1, and that Kiteworks continues to recommend customers run the latest software version. The company declined to provide further details when asked whether the threat was linked to a specific CVE or which threat groups might be involved.
Kiteworks Declines to Confirm Zero-Day, Cites Past Accellion Breach
A Kiteworks customer support official told the German outlet Heise that the advisory was issued due to a potential "zero-day" vulnerability, though no technical details or proof of exploit were shared publicly. The FBI declined to comment on the matter, and the Cybersecurity and Infrastructure Security Agency (CISA) did not respond to requests for information.
The warning echoes past security incidents involving the company. Kiteworks was formerly known as Accellion and operated a widely used file transfer tool until December 2020, when a Russian hacking group called Clop exploited a zero-day vulnerability in the Accellion FTA appliance to steal data from dozens of high-profile organizations.
Among the victims of that breach were the University of Colorado, the Washington State Auditor’s Office, Flagstar Bank, aircraft manufacturer Bombardier, and the U.S. retail chain Kroger. The incident led to widespread criticism of Accellion’s security practices and ultimately contributed to the company’s rebranding as Kiteworks.
Security Experts Question Unprecedented Customer Shutdown Request
Jake Knott, a senior official at cybersecurity firm watchTowr, said his team is actively monitoring the situation but expressed concern over the unusual nature of Kiteworks’ recommendation.
"There is no known CVE, patch, or additional technical details available – but nobody requests that their entire customer base unplug production systems over the weekend because of a hunch."
— Jake Knott, Senior Official, watchTowr
Knott noted that despite the rebranding and passage of time, the underlying risks associated with managed file transfer (MFT) appliances remain attractive to attackers. He warned that historical patterns suggest threat actors continue to target such platforms, and there is no reason to believe this incident would be any different.
"Whilst years have passed and the name has changed, attackers' appetites for targeting [managed file transfer] appliances has not, and we have no reason to believe this time will be any different. In other words, this is familiar territory, but not the comforting kind," Knott added.
As of the publication of this report, Kiteworks has not released indicators of compromise, technical signatures, or a CVE identifier related to the suspected threat. The company maintains that the advisory was issued purely as a preventive measure while investigations with law enforcement partners are ongoing.
Source: The Record