Kiteworks orders servers shut down for six hours over a possible imminent zero-day attack

Kiteworks, the secure file-sharing software company, has asked its customers worldwide to temporarily shut down their servers during a six-hour window on Saturday, after receiving threat intelligence warning of a possible imminent cyberattack. According to German technology publication Heise, the company's CISO, Frank Balonis, emailed customers warning that Kiteworks had received "credible threat intelligence from law enforcement indicating that an attack on Kiteworks systems may be imminent this weekend," and strongly recommended shutting the system down for six hours.

The shutdown window applied to customers across multiple time zones, from Australian Eastern Standard Time (AEST) to Pacific Time (PDT). In Central Europe, customers were asked to shut down their Kiteworks systems between 4:00 and 10:00 a.m. on Saturday, September 26; in New York, the equivalent window ran from 10:00 p.m. Friday to 4:00 a.m. Saturday. The company also recommended shutting down servers before that window began, and doing so even for systems not directly accessible from the internet.

Kiteworks confirmed the notice to BleepingComputer, noting it had received intelligence from federal authorities indicating that a threat actor might attempt to attack some customer systems. The company stressed that this is a preventive measure and not a response to a confirmed breach: "We are not aware of any compromise of Kiteworks systems, and this notice is preventive and not a response to a confirmed breach," the company said, adding that all known vulnerabilities are fixed in its current version, 9.5.1, and that it recommends customers always run the latest version.

There is, however, some discrepancy in the explanations given. Heise reported that when it contacted Kiteworks support to verify the notice, the company itself said the reason for asking customers to shut down servers was to "protect against possible zero-day attacks." Neither the official statement to BleepingComputer nor the customer notification cited by Heise explicitly confirms that a zero-day vulnerability has been discovered or exploited; Kiteworks insists that all known vulnerabilities are already patched and describes the measure as purely precautionary, based on intelligence received from the authorities.

Kiteworks develops secure file transfer and communications products used by government agencies, financial institutions and businesses. Because such platforms typically store sensitive documents, they are a valuable target for cybercriminals carrying out data-theft attacks for extortion purposes. Although it is not known which threat actor might be linked to this possible attack, the article recalls that the extortion group Clop has a long history of attacking enterprise platforms of this kind, including the Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo and MOVEit Transfer cases. Notably, the U.S. State Department currently offers a $10 million reward for any information linking this cybercriminal group's attacks to a foreign government.

Taken together, the episode illustrates a trend that has become common in enterprise cybersecurity: critical software vendors that, faced with threat indications not yet publicly confirmed, opt for drastic and highly visible measures —such as calling for a coordinated shutdown of servers worldwide— rather than waiting for full confirmation. For Kiteworks customers, the recommendation means a brief but global operational disruption, justified by the sensitivity of the data these platforms usually handle and by the historical pattern of large-scale attacks on enterprise file transfer software.