File transfer firm Kiteworks asks thousands of customers to shut their systems for 6 hours on 26 September after a threat warning from federal authorities

According to a 25 September report by The Record, Kiteworks' chief information security officer wrote that they had received credible threat intelligence from federal intelligence authorities that a threat actor could target some Kiteworks systems. TechCrunch reported the same statement as a warning originating from law enforcement; the two sources use different wording on which agency the warning came from. According to BleepingComputer, the shutdown window runs from 04:00 to 10:00 Central European Time on 26 September, or from 22:00 on 25 September to 04:00 on 26 September New York time; the recommendation also covers installations not exposed to the internet, and the company is asking customers to move to version 9.5.1. According to The Record, the FBI declined to comment and CISA did not respond; no CVE number or threat actor name has yet been disclosed.

According to TechCrunch, at least 1,000 Kiteworks systems are exposed on the internet and thousands of customers in the healthcare, technology, education, automotive and public sectors could be affected; one healthcare customer reported delays in patient communications because it shut its server down immediately. A customer support official was reported to have referred to a possible zero-day flaw, without giving details. The file transfer product of the company's predecessor, Accellion, was compromised in December 2020 in a zero-day attack by the Clop group, and according to TechCrunch data was stolen from hundreds of organisations. No confirmed breach or number of affected customers has been disclosed; the source of the threat could not be verified.