Kiteworks Urges Customers to Restart Systems After Shutdown Notice

A popular managed file transfer (MFT) provider has lifted a temporary shutdown notice for customers which it put in place after a tip-off from “federal intelligence authorities.”

Kiteworks said in an update on September 27 that customers can now bring systems back online.

“Customers with self-hosted Advanced Forms should contact Customer Support for assistance,” it explained. “All systems Kiteworks hosts on customers’ behalf have been brought back up and are operating normally.”

Read more on managed file transfer threats: Critical Zero-Day Flaw Exploited in MOVEit Transfer.

The MFT vendor issued customers the highly unusual advisory to shut down their systems as a precautionary measure for nine hours on September 25.

The order was aimed at customers who self-manage their Kiteworks systems, either on-premises or via AWS/Azure. Kiteworks said it would shut down systems that it hosts during the same time period.

“Kiteworks received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems,” said Frank Balonis, Kiteworks CISO.

“Out of an abundance of caution, we notified customers directly and recommended a precautionary shutdown window while we continue to work through the matter with federal intelligence authorities.”

Balonis said the order was preventative and that there had been no reports of a confirmed breach.  

“Kiteworks has accounted for all known vulnerabilities in our current release, 9.5.1, and we continue to recommend customers run the latest version,” he added.

Speculation Mounts Over Threat

It’s still unclear what the imminent threat may have been, although speculation online is that a malicious actor may have been preparing to exploit a zero-day vulnerability in attacks.

MFT platforms have been lucrative targets for cybercriminals in the past, with the likes of Accellion, GoAnywhere, Cleo and MOVEit all breached.

In the case of 2023’s MOVEit campaign, the notorious Cl0p extortion group compromised nearly 3000 corporate customers, compromising the data of over 90 million downstream customers.

Black Hills Information Security owner, John Strand, expressed surprise at the original Kiteworks announcement.

“This is wild. This isn’t an active attack. People aren’t actively being breached, and yet the vendor is telling customers to take their systems offline. I’ve never heard of anything like this before,” he said.

However, Suzu Labs senior consultant, Phil Wylie, argued that the order was a good example of threat intelligence being used proactively.

"When credible intelligence suggests an attack may be imminent, organizations shouldn't wait for a confirmed compromise before taking action,” he said.

“Security teams should evaluate the credibility of the intelligence, determine their exposure, increase monitoring, preserve logs, verify that systems are fully patched, review privileged access, and consider temporarily isolating or disabling systems when the potential impact justifies the disruption.”