Kiteworks Urges Customers to Shut Down Systems Amidst Credible Threat Intelligence
Kiteworks has alerted its customers to cease using its platform due to credible threat intelligence from federal agencies indicating a potential targeting by threat actors.
Software company Kiteworks has issued an urgent warning to its customers, advising them to shut down the platform over the weekend due to credible threat intelligence from federal intelligence authorities. The alert, first reported by German news outlet Heise, recommended a six-hour shutdown window on Saturday.
Frank Balonis, CISO at Kiteworks, confirmed the advisory, stating that the company "received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems for customers." He emphasized that the recommendation was made "out of an abundance of caution" while the company and law enforcement partners investigate the matter. Balonis also noted that Kiteworks is not aware of any compromise of its systems and that all known vulnerabilities are addressed in their latest release, version 9.5.1.
Despite the company's assurances that all known vulnerabilities are patched, the unusual nature of the warning has raised concerns. A Kiteworks customer support official reportedly told Heise that the email was sent due to a potential "zero-day" vulnerability, though no specific CVE identifier has been released. The company has not provided further details on the nature of the threat or potential threat actors involved.
The FBI declined to comment on the situation, and the Cybersecurity and Infrastructure Security Agency (CISA) did not respond to requests for comment. This lack of official confirmation from government agencies adds to the uncertainty surrounding the advisory.
Jake Knott, a senior official at cybersecurity firm watchTowr, highlighted the peculiarity of Kiteworks' request for customers to power down their production servers. "There is no known CVE, patch, or additional technical details available – but nobody requests that their entire customer base unplug production systems over the weekend because of a hunch," Knott stated. He also drew parallels to past incidents involving Kiteworks, which was formerly known as Accellion.
Kiteworks, previously Accellion, has a history of security incidents. In December 2020, a zero-day vulnerability in its file transfer tool was exploited by the Russian hacking group Clop, leading to data theft from numerous high-profile organizations, including the University of Colorado, the Washington State Auditor Office, and retail chain Kroger.
Knott further commented on the persistent appeal of managed file transfer (MFT) appliances to attackers, stating, "Whilst years have passed and the name has changed, attackers' appetites for targeting managed file transfer appliances has not, and we have no reason to believe this time will be any different. In other words, this is familiar territory, but not the comforting kind."
The current situation underscores the ongoing risks associated with file transfer solutions and the critical importance of timely threat intelligence, even when specific technical details remain undisclosed.
The advisory from Kiteworks specifies a nine-hour shutdown window for customers over the weekend. While the company has not detected any compromises, it recommends applying the latest software release, version 9.5.1, which addresses all known vulnerabilities for optimal protection. Other Kiteworks subsidiaries, including Zivver and ownCloud, are not affected by this advisory.
Kiteworks has since lifted its recommendation for customers to shut down their servers, stating that no compromise was confirmed and that all known vulnerabilities have been addressed in version 9.5.1. The company also clarified that the incident did not affect its subsidiaries and urged customers to ensure they are running the latest version of the software.
Kiteworks has announced that the precautionary shutdown recommendation for its customers has been lifted, and systems can now be brought back online. The company confirmed that all systems it hosts on behalf of customers are operating normally, while self-hosted Advanced Forms instances require customer support assistance. This update follows the initial recommendation for a nine-hour shutdown due to a severe vulnerability in the Advanced Forms product, which Kiteworks stated was confined to less than 1% of its customers and had no evidence of exploitation at the time.
Kiteworks has lifted its precautionary shutdown advisory for customers, stating that continuous monitoring over the weekend revealed no abnormal activity. The company confirmed that a critical, previously unknown vulnerability in its Advanced Forms tool was discovered and patched during the shutdown period, and recommended customers update to release 9.5.1.
Kiteworks has now patched the critical vulnerability that was discovered during the precautionary shutdown. The company stated that the flaw was confined to a specific capability used by less than 1% of its customer base and that no evidence suggests it was exploited. The fix was developed and deployed during the shutdown window, with an additional protective layer applied across all environments.