Kiteworks tells users to shut down servers amid fears of 'imminent' cyberattack

Date:
Mon, 28 Sep 2026 14:20:00 +0000

Description:
The police notified Kiteworks of apparently imminent attack, leading to the company reacting fast.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Kiteworks warned customers of a credible planned cyberattack, urging a ninehour precautionary shutdown No breaches reported; advisory lifted Sept 27, systems restored, version 9.5.1 deemed secure Context recalls Cl0ps past filesharing platform hits, raising speculation about possible resurgence Secure file sharing company Kiteworks recently told its customers to shut down their servers for nine hours, in anticipation of an incoming cyberattack.

There are no reports of actual attacks - at least not yet, but in a blog
post, the company revealed it had received credible threat intelligence from federal authorities warning them of a planned attack against the company and its customers. In response, the company told its customers to shut down their servers for nine hours, depending on their timezone. Latest Videos From TechRadar Watch full video here: What happened? Kiteworks is advising customers to facilitate a nine-hour precautionary shutdown window this weekend, in their local time zone, the announcement reads.

Customers who self-manage their Kiteworks systemson-premises or on AWS or Azureshould shut down those systems themselves during this window. Kiteworks will shut down the customer systems it hosts, on behalf of customers, during the same window, so Kiteworks-hosted customers are not required to take any action. You may like Cybercrime civil war brewing? ShinyHunters reportedly hacks Cl0p ransomware gang and threatens further damage ShinyHunters hackers claim to have hit data center provider used by Microsoft and Meta Ransomware gang crashes own attack with no-one to blame but themselves

In the announcement, the companys Chief Information Security Officer, Frank Balonis, said the measure is proactive rather than reactive, and that there are no ongoing attacks just yet:

Out of an abundance of caution, we notified customers directly and
recommended a precautionary shutdown window while we continue to work through the matter with federal intelligence authorities, Balonis said. Are you a
pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting
your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

We have no indication that Kiteworks or our customers systems have been compromised, so this advisory is preventative rather than a response to a confirmed breach.

Citing German media, BleepingComputer said the shutdown window applies to customer worldwide, with affected time zones ranging from Australian Eastern Standard Time, to Pacific Daylight Time. In Central Europe, customers were told to shut down between 4 and 10 AM on Saturday. On the east coast of the US, the shutdown window is between 10PM on a Friday, until 4AM on Saturday. Who could be gearing up for an assault? Kiteworks is a US-based enterprise security and secure data-sharing platform , which organizations can use to manage sensitive information, especially when ordinary email attachments or consumer file-sharing services arent considered secure enough. What to read next Swiss government says SharePoint-linked data breach affected hundreds of accounts Japan's largest taxi operator Nihon Kotsu hit by cyberattack KFC may be forced to shut some stores following cyberattack at key supplier

Kiteworks says it does not have any fixes in the pipeline and that all known vulnerabilities are accounted for in the latest version 9.5.1. Obviously, customers are advised to run this version instead of older, potentially vulnerable ones, and were told that other subsidiaries such as Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder,
were not affected.

Secure data-sharing platforms are an attractive target for cybercriminals, given the high-value organizations that use them, as well as the sensitive information they handle. We dont know who the attackers might be, but there are some strange coincidences occurring at the moment.

Three years ago, a hacking group known as Cl0p struck two major file-sharing platforms: GoAnywhere MFT and MOVEit. The breaches ended up becoming some of the biggest hits in recent history , affecting thousands of customers.
Victims ranged from government agencies, schools and healthcare, to major firms like Sony and PricewaterhouseCoopers (PwC).

Cl0p tried to extort many of these companies, even succeeding with some. The cybersecurity community tried to estimate how much money the group stole this way, and the general consensus seems to be anywhere between $40 and $100 million.

In the months and years following these two incidents, Cl0p vanished. The group was no longer making high-level plays, and weve not reported on any major breaches since. Until last week, that is, when it was reported that ShinyHunters - currently one of the most active and dangerous data exfiltration organizations around - attacked Cl0p .

ShinyHunters leaked plenty of Cl0ps sensitive data, saying it did so in retaliation for threats of doxxing and physical violence made by the group.
We dont know if Cl0p was preparing to hit Kiteworks, but we wouldnt be too surprised if it was an attempted brand management after being somewhat embarrassed by ShinyHunters.

So far, there were no reports of actual breaches at any of Kiteworks customers, but were continuing to monitor the situation.

The company said that as of September 27 2026, the shutdown recommendation
has been lifted for all customers. If you have not already restarted, you may bring your Kiteworks system back online. Customers with self-hosted Advanced Forms should contact Customer Support for assistance. All systems Kiteworks hosts on customers behalf have been brought back up and are operating normally. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/kiteworks-tells-users-to-shut-down-serv ers-amid-fears-of-imminent-cyberattack


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)