Kiteworks orders precautionary customer shutdown after credible threat intelligence

Kiteworks told customers to prepare for a nine-hour precautionary shutdown window after receiving credible threat intelligence from federal authorities. The company said there is no indication of a breach and that current release 9.5.1 addresses all known vulnerabilities.

Why it matters: - Kiteworks is asking customers to temporarily power down systems as a preventative move after federal intelligence pointed to a possible threat. - The advisory affects customers running Kiteworks on-premises or in AWS or Azure, which could create short-term operational disruption. - Kiteworks-hosted customers do not need to take action because Kiteworks will shut down those systems for them.

What happened: - Kiteworks issued a precautionary advisory to customers after receiving credible threat intelligence from federal intelligence authorities. - The company recommended a nine-hour shutdown window this weekend in each customer’s local time zone. - Customers who self-manage Kiteworks systems on-premises or in AWS or Azure should shut down those systems during the window. - Kiteworks said it will shut down customer systems it hosts during the same window. - Frank Balonis, Kiteworks chief information security officer, said the company notified customers directly and is working with federal intelligence authorities.

The details: - Kiteworks said there is no indication that Kiteworks or customer systems have been compromised. - The company said the advisory is preventative and not a response to a confirmed breach. - Kiteworks said all known vulnerabilities are addressed in current release 9.5.1. - The company continues to recommend that customers run the latest version. - The threat does not affect other Kiteworks subsidiaries, including Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai and 123FormBuilder. - Kiteworks said an email advisory went to customers with the specific hours and the recommended nine-hour timeframe. - Customers were directed to contact Kiteworks Technical Support by email at support@kiteworks.com, through the customer portal, or on the support page. - Support phone lines were listed for North America, international callers, Australia, Germany, Israel, New Zealand, Singapore and the UK.

Between the lines: - The move suggests Kiteworks is prioritizing containment and caution before any confirmed exploitation appears. - By framing the advisory as preventative, Kiteworks is signaling that the request is intended to reduce risk rather than react to an active incident. - The explicit note that subsidiaries are not affected helps limit uncertainty for customers of Kiteworks-owned brands.

What's next: - Customers with self-managed deployments will need to follow the shutdown window in their local time zone. - Kiteworks said it will continue working through the matter with federal intelligence authorities. - The company is steering customers toward release 9.5.1 and continued use of the latest version.

The bottom line: - Kiteworks is treating the threat as credible enough to warrant a temporary shutdown, but not as evidence of a breach.