Kiteworks Tells Clients to Take Systems Offline for Nine Hours Citing Imminent Cyber Threat

Kiteworks, a maker of software for transferring large and sensitive files, is advising customers to take their systems offline for a nine-hour window over the weekend after receiving what it described as credible intelligence a possible imminent cyberattack.

The San Mateo, California-based company, formerly known as Accellion, said the warning is precautionary and that it has not found evidence that any customer systems have been compromised. The advisory was first reported by German technology publication Heise, which obtained a copy of an email Kiteworks sent to customers.

Frank Balonis, Kiteworks' chief information security officer, said the company "received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems." He added that the firm notified customers directly and recommended a shutdown window "out of an abundance of caution" while it continues working with authorities.

The company did not identify which law enforcement agency provided the intelligence or which hacking group may be behind the threat. The FBI and the U.S. Cybersecurity and Infrastructure Security Agency did not respond to requests for .

In the customer email, Kiteworks expressed concern the exploitation of vulnerabilities that are currently unknown to the vendor — so-called zero-day flaws that give the company no time to patch before an attack occurs. The message urged customers to shut down systems before the weekend, if not sooner, to protect against any potential zero-day attacks, according to a copy reviewed by TechCrunch.

Balonis said all known vulnerabilities have been addressed in the latest software release, version 9.5.1, which the company recommends all customers apply. Other Kiteworks subsidiaries, including Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder, are not affected by the advisory.

It is unclear how many customers may be impacted. Kiteworks states on its website that it serves thousands of organizations across healthcare, technology, education, automotive, and government sectors. Security researcher Kevin Beaumont pointed to listings showing at least a thousand internet-facing Kiteworks systems online.

A history of targeting

The warning comes nearly six years after a damaging breach of the company's file-transfer product under its Accellion brand. In late 2020 and early 2021, the Clop ransomware group, also tracked as UNC2546, exploited multiple zero-day vulnerabilities in the legacy file transfer appliance to steal data from hundreds of organizations and extort them.

That campaign was part of a broader wave of attacks targeting file-transfer products, where hackers stole copies of data that had been sent over the internet but not deleted from affected servers, then threatened to publish the information unless victims paid.

The current advisory suggests Kiteworks is attempting to avoid a repeat of that incident by acting before any confirmed compromise. The company has not disclosed the specific hours of the recommended shutdown window beyond describing it as a nine-hour period over the weekend, and it said it sent an email to all customers with details.

For organizations that rely on Kiteworks for regulated data transfers in healthcare and government, the advisory creates an operational challenge: taking systems offline for nine hours may disrupt critical workflows, but ignoring the warning carries the risk of a zero-day compromise with no patch available.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.