Kiteworks tells customers to shut down systems after threat intelligence alert

Kiteworks issued a precautionary notice to customers after receiving credible threat intelligence from U.S. federal authorities. The company says no compromise has been detected and that known vulnerabilities were already fixed in version 9.5.1.

Why it matters: - Kiteworks is asking customers to take systems offline for nine hours this weekend as a precaution against a possible targeted attack. - The guidance affects self-managed deployments on-premises, AWS, and Azure, as well as Kiteworks-hosted customer systems. - The notice matters because the company says there is no evidence of compromise, but it is still urging a shutdown to reduce risk.

What happened: - Kiteworks issued a precautionary advisory after receiving credible threat intelligence from U.S. federal intelligence authorities. - Frank Balonis, Kiteworks chief information security officer, said the warning points to a possible attempt by a malicious actor to target certain Kiteworks systems. - Kiteworks notified customers directly and recommended a preventive shutdown period while it continues discussions with federal intelligence authorities. - Kiteworks said the advisory does not apply to other Kiteworks subsidiaries, including Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai and 123FormBuilder.

The details: - Customers that manage their own Kiteworks systems must shut those systems down during the recommended nine-hour window in their local time zone. - Kiteworks will shut down customer systems it hosts on behalf of those customers during the same period. - Customers with Kiteworks-hosted systems do not need to take any action. - Kiteworks said all known vulnerabilities have been fixed in version 9.5.1, and the company continues to recommend that customers use the latest version. - The company said it has seen no evidence of compromise affecting Kiteworks systems or customer systems. - Kiteworks sent an email notice to all customers with the exact timing and the recommended nine-hour window. - The advisory provides support contacts by email at support@kiteworks.com and through the customer portal and support site. - Support resources include the community portal and Kiteworks support.

Between the lines: - The shutdown recommendation suggests Kiteworks is treating the intelligence as credible enough to warrant disruption, even without confirmed intrusion. - The company is signaling a defense-first posture by prioritizing temporary service interruption over waiting for a confirmed incident. - The explicit carve-out for subsidiaries indicates the warning is narrow and tied to specific Kiteworks systems rather than the broader corporate portfolio.

What's next: - Customers should follow the emailed timing instructions and complete the preventive shutdown within the local nine-hour window. - Kiteworks said it will continue coordinating with federal intelligence authorities on the threat. - Customers with questions about their environment are being directed to Kiteworks technical support.