Kiteworks tells customers to shut down servers over 'imminent' attack threat

Kiteworks (formerly Accellion), which builds tools for sending large files and sensitive datasets over the internet, has urged its customers to shut down their systems. The move follows information the company received about a possible attack in the works.

The story was first reported by German outlet Heise, which cited an email Kiteworks sent to customers warning of an "imminent" attack that could come as soon as this weekend. The company later confirmed the notice to TechCrunch.

A tip from law enforcement

Kiteworks chief information security officer Frank Balonis said the company "received credible threat intelligence from law enforcement indicating that a threat actor may attempt to target some Kiteworks systems for customers." As a precaution, he said, customers were notified directly and advised to shut systems down while the company and its law enforcement partners work through the matter.

Balonis stressed that Kiteworks is not aware of any compromise of its systems and that the advisory is preventative rather than a response to a confirmed breach. The company would not name the agency that alerted it or the hacking group that might be behind the threat. The FBI declined to comment, and U.S. cybersecurity agency CISA did not immediately respond.

Fears of a zero-day

In the email, the company said it was worried about the exploitation of vulnerabilities currently unknown to Kiteworks itself — so-called zero-day flaws that give the vendor no time to patch. Customers were urged to shut systems down before the weekend, if not sooner. Balonis noted that all known vulnerabilities have been fixed in the latest release, 9.5.1, which the company recommends everyone install.

Exactly how many customers may be affected is unclear. Kiteworks says on its website that it has thousands of customers across healthcare, technology, education, automotive, and government. Security researcher Kevin Beaumont pointed to at least a thousand internet-facing Kiteworks systems, though that figure likely overstates the number actually affected.

One customer who works in healthcare told TechCrunch they immediately took down their organization's server; the outage is disrupting doctors' ability to reach their patients.

Not the first time

This is not the company's first brush with cyberattacks. Before its rebrand from Accellion in late 2021, a flaw in its file-transfer application let an extortion gang mass-hack and steal data from hundreds of organizations. That campaign was part of a wider hunt for file-transfer products, with attackers seeking copies of data that had been sent earlier but never deleted from servers — then demanding ransom under threat of publication.

Source: TechCrunch