Kiteworks urges customers to shut down their servers amid ‘imminent’ threat of cyberattack

Kiteworks has warned its customers to shut down Kiteworks systems temporarily after receiving what it described as credible threat intelligence from law enforcement that a threat actor might attempt to target some customer systems. The company framed the advisory as preventive, saying it had no indication of a current compromise and that it recommended a shutdown window while it and law enforcement investigate.

Chief information security officer Frank Balonis told TechCrunch the company acted "out of an abundance of caution" and urged customers to apply its latest patched release, version 9.5.1, which Kiteworks says fixes all known vulnerabilities. In communications shared with TechCrunch, Kiteworks expressed concern about the possible exploitation of zero-day bugs — flaws unknown to the vendor that would not have time for preemptive fixes.

Kiteworks did not identify which law-enforcement agency provided the intelligence or name any suspected hacking group. The FBI declined to comment, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) had not immediately responded to requests for comment, according to TechCrunch. It is unclear how many customer systems could be affected; Kiteworks states it serves thousands of customers across healthcare, technology, education, automotive and government sectors.

Security researcher Kevin Beaumont noted at least a thousand internet-facing Kiteworks systems listed online, though he cautioned that figure may overcount potentially affected servers. At least one Kiteworks customer in the healthcare sector reported taking down its server after receiving the alert, saying the outage disrupted clinicians’ ability to contact patients. Kiteworks previously suffered a major incident in the Accellion era in late 2021 when a vulnerability in its file-transfer product was exploited in a widespread extortion campaign that affected hundreds of organizations.