Kiteworks Urges Precautionary Server Shutdown Amid Imminent Cyber Threat

Kiteworks, a provider of secure file-transfer and communications software, has advised its global customer base to implement a six-hour server shutdown this weekend. The recommendation follows credible threat intelligence from federal authorities suggesting a cyberattack may be imminent.

Kiteworks CISO Frank Balonis notified customers that the advisory is a precautionary measure. While the company has stated it is not currently aware of any compromise of its systems, the shutdown is intended to mitigate the risk of an impending attack.

Shutdown Windows and Mitigation

The recommended shutdown applies to customers worldwide. The company has advised that customers should ideally shut down their systems before the scheduled windows to ensure adequate protection. The specific windows include:

• New York: 10:00 p.m. Friday to 4:00 a.m. Saturday.
• Central Europe: 4:00 a.m. to 10:00 a.m. Saturday.

Kiteworks has recommended that customers take their systems offline even if the servers are not directly accessible from the internet. The company also noted that all currently known vulnerabilities are addressed in its latest release, version 9.5.1, and continues to recommend that customers run this version.

Potential Zero-Day Concerns

Although Kiteworks has not officially confirmed that a new vulnerability has been discovered or exploited, the company’s support staff reportedly indicated that the shutdown is intended to protect against potential zero-day attacks. A zero-day vulnerability refers to a security flaw that is unknown to the software vendor and for which no patch is yet available.

Kiteworks develops secure file-sharing and communication products used extensively by government organisations, financial institutions, and large enterprises. Because these platforms often store highly sensitive documentation, they are high-value targets for cybercriminals conducting data-theft extortion attacks.

While no specific threat actor has been linked to this imminent threat, security researchers have previously observed extortion groups, such as Clop, targeting similar enterprise file-transfer platforms to facilitate large-scale data breaches and ransomware campaigns.