Secure file-sharing software company Kiteworks is asking customers worldwide to temporarily shut down their servers for a period of six hours on Saturday after receiving a threat alert of a possible impending cyberattack.
According to German technology publication HeiseKiteworks CISO Frank Balonis warned customers via email that the company had received “credible threat intelligence from law enforcement indicating that an attack on Kiteworks systems may be imminent this weekend.”
“We strongly recommend that you shut down your Kiteworks system for six hours,” the notification reads.
According to Heise, the shutdown window applies to customers worldwide, with affected time zones ranging from Australian Eastern Standard Time (AEST) to Pacific Daylight Time (PDT).
In Central Europe, customers have been instructed to turn off Kiteworks systems between 4:00 a.m. and 10:00 a.m. on Saturday, September 26th. In New York, the shutdown window would be 10 p.m. Friday to 4 a.m. Saturday.
The company reportedly recommends shutting down servers ahead of the scheduled time frame and says customers should take systems offline even if they are not directly accessible via the Internet.
The company confirmed the warning to BleepingComputer, saying it had received information from federal authorities that a threat actor may be attempting to attack some customer systems.
“Kiteworks has received credible threat intelligence from federal intelligence agencies indicating that a threat actor may attempt to attack some Kiteworks systems for customers,” the company told BleepingComputer.
“Out of an abundance of caution, we notified customers directly and recommended a precautionary shutdown window while we and our law enforcement partners address the matter.”
Kiteworks emphasized that the warning was a precautionary measure rather than a response to a confirmed breach.
“We are not aware of any compromise of Kiteworks systems and this notice is intended as a preventive measure rather than a response to a confirmed breach,” the company said.
“All known vulnerabilities are addressed in our current version 9.5.1 and we continue to recommend customers use the latest version.”
Possible zero-day concerns
While Kiteworks has not confirmed that attackers are exploiting an unknown vulnerability, Heise reports that Kiteworks customer support said the shutdown advisory is intended to protect customers from potential zero-day attacks.
“We ask that you shut down the servers to protect us from possible zero-day attacks,” Kiteworks support reportedly told Heise when the publication contacted the company to verify the alert.
However, neither the statement to BleepingComputer nor the customer communication quoted by Heise confirm that a zero-day vulnerability was discovered or exploited.
Instead, Kiteworks says that all currently known vulnerabilities in version 9.5.1 have been fixed and describes the shutdown as a precautionary measure based on findings from authorities.
Kiteworks develops secure file transfer and communications products used by government organizations, financial institutions and businesses.
Because secure file sharing platforms often store sensitive documents, they are a valuable target for cybercriminals carrying out data theft extortion attacks.
While it is unknown which threat actor is associated with these potential attacks, the Clop extortion gang has long targeted data theft attacks on enterprise platforms, including Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer.
The US State Department is now offering a $10 million reward for any information linking the cybercriminal gang’s attacks to a foreign government.
