Kiteworks tells customers to shut down even internal file-sharing servers for six hours
Kiteworks told customers worldwide to power off its file-sharing servers for six hours on September 26 after a federal warning of a possible attack. Servers with no internet exposure are included, so being on release 9.5.1 with every known fix does not by itself clear a customer.
The Watch · Security desk
What happened
- Kiteworks asked customers to shut down its servers for six hours on Saturday, September 26, from 4 to 10 a.m. in Central Europe and from 10 p.m. Friday to 4 a.m. Saturday in New York.
- The company said federal intelligence authorities warned it that a threat actor may try to target some customers' Kiteworks systems.
- Heise reported that Kiteworks wants servers off before the window starts, including servers that cannot be reached from the internet.
- Kiteworks did not answer follow-up questions on whether a CVE exists or which group is behind the threat.
Why it matters
- What doesn't add up contradiction The support desk's zero-day explanation and the CISO's claim that every known flaw is fixed are both true only if the threat is unknown or undisclosed, so a fully patched customer cannot assume it is covered.
- Who's exposed exposure Because servers behind the firewall are in scope, a customer cannot rule itself out by showing its Kiteworks instance has no public address.
- What it limits constraint The shutdown covers six hours. Restarted servers run the same code as before, so protection after Saturday depends on a fix or indicators Kiteworks has not published.
- What it sets up precedent If file-transfer flaws spread the way Knott describes, the first public technical detail will bring indiscriminate exploitation, and customers who restarted without a fix will be in its path.
Next story · Security · Oct 4
Third NetScaler zero-day hits SAML appliances already patched against the first twoConfirmed11 publishers
"We strongly recommend you shut down your Kiteworks system for six hours," the customer notification reportedly states [19]. Heise reported that the email, from chief information security officer Frank Balonis, cited law enforcement intelligence "indicating an attack on Kiteworks systems may be imminent this weekend" [1]. Kiteworks sells file-transfer and communications products to government organizations, financial institutions and enterprises [16].
Kiteworks staff have explained the shutdown in two ways [4][8]. A customer support official told Heise: "The reason we're asking you to shut down the servers is to protect against any potential zero-day attacks." [4] Balonis told Recorded Future News: "All known vulnerabilities are addressed in our current release, 9.5.1, and we continue to recommend customers run the latest version." [8] BleepingComputer noted that neither the company statement nor the customer notification confirms that a zero-day has been discovered or exploited [6]. The FBI declined to comment and CISA did not respond, according to Recorded Future News [10].
Nick DiCola, chief AI security and customer officer at Zero Networks, took the internal-server instruction as a clue to the threat. "If the company is saying 'shut it down' even if it's not exposed, then you have to assume the Zero-Day is something already running on the system and has a C2 channel waiting for a command to 'execute,'" he wrote in an email to SC Media [17]. DiCola was reasoning from the wording of the notice. Balonis said: "We are not aware of any compromise of Kiteworks systems, and this advisory is preventative rather than a response to a confirmed breach." [3]
Kiteworks used to be Accellion [11]. In December 2020, Clop used a zero-day in Accellion's file transfer tool to steal data from dozens of companies, among them Kroger, Bombardier and Flagstar Bank [11]. The gang's record of data-theft campaigns against enterprise file platforms also includes GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo and MOVEit Transfer [12]. No actor has been publicly linked to this weekend's warning [12].
Jake Knott of watchTowr said his firm is tracking the threat, and that "nobody requests that their entire customer base unplug production systems over the weekend because of a hunch" [13]. He also told SC Media that suggesting a shutdown "is both unusual and never a good sign, especially when the remediation is the power button" [15]. "Vulnerabilities impacting MFT appliances rarely remain a secret for long, and typically rapidly accelerate from targeted exploitation to indiscriminate, in-the-wild exploitation, with both researchers and attackers likely already throwing the codebase through their favorite LLMs," Knott said [14].
What to watch
- A Kiteworks advisory with a CVE number or a release after 9.5.1, either of which would confirm a flaw outside the set the company calls known.
- An FBI or CISA statement naming the actor, or a CISA Known Exploited Vulnerabilities entry for a Kiteworks product.
- Leak-site claims from Clop or another group naming Kiteworks customers after the September 26 window.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+20
- Incentives45
- Confidence62
Perspective Coverage
5 publishers- Builder
- Builder 18%
- Operator
- Operator 73%
- Investor
- Investor 9%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
According to Heise, Kiteworks CISO Frank Balonis emailed customers that the company had received "credible threat intelligence from law enforcement indicating an attack on Kiteworks systems may be imminent this weekend."
- [2]
Balonis told Recorded Future News the company "received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems for customers."
- [3]
"We are not aware of any compromise of Kiteworks systems, and this advisory is preventative rather than a response to a confirmed breach."
- [4]
"The reason we're asking you to shut down the servers is to protect against any potential zero-day attacks," Kiteworks support reportedly told Heise.
- [5]
Customers in Central Europe were instructed to shut down Kiteworks systems between 4:00 a.m. and 10:00 a.m. on Saturday, September 26; in New York the window runs from 10:00 p.m. Friday to 4:00 a.m. Saturday.
- [6]
Neither the statement Kiteworks provided to BleepingComputer nor the customer notification quoted by Heise confirms that a zero-day vulnerability has been discovered or exploited.
- [7]
According to Heise, Kiteworks recommends shutting down servers before the scheduled window and says customers should take systems offline even if they are not directly accessible from the internet.
- [8]
"All known vulnerabilities are addressed in our current release, 9.5.1, and we continue to recommend customers run the latest version."
- [9]
Kiteworks did not respond to follow-up questions from Recorded Future News about whether the bug had a CVE yet or what groups are exploiting the platform.
- [10]
The FBI declined to comment and CISA did not respond to requests for comment.
- [11]
Kiteworks was previously known as Accellion; in December 2020 Clop used a zero-day vulnerability in its file transfer tool to steal data from dozens of high-profile companies, including the University of Colorado, the Washington State Auditor Office, Flagstar Bank, Bombardier and Kroger.
- [12]
It is not known which threat actor is linked to the potential attacks; Clop has a long history of data-theft attacks on enterprise platforms including Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo and MOVEit Transfer.
- [13]
Jake Knott of watchTowr said they are actively tracking the threat and said "nobody requests that their entire customer base unplug production systems over the weekend because of a hunch."
- [14]
"Vulnerabilities impacting MFT appliances rarely remain a secret for long, and typically rapidly accelerate from targeted exploitation to indiscriminate, in-the-wild exploitation, with both researchers and attackers likely already throwing the codebase through their favorite LLMs," Knott said.
- [15]
Knott told SC Media that "suggesting a customer shut down their servers is both unusual and never a good sign, especially when the remediation is the power button."
- [16]
Kiteworks develops secure file-transfer and communications products used by government organizations, financial institutions, and enterprises.
- [17]
"If the company is saying 'shut it down' even if it's not exposed, then you have to assume the Zero-Day is something already running on the system and has a C2 channel waiting for a command to 'execute,'" Nick DiCola, Zero Networks Chief AI Security and Customer Officer, wrote in an email to SC Media.
- [18]
Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window after receiving threat intelligence warning of a potentially imminent cyberattack.
- [19]
"We strongly recommend you shut down your Kiteworks system for six hours," the notification reportedly states.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comKiteworks urges 6-hour server shutdown over potential zero-day attacks
2 articles · September 25, 2026
- nakedsecurity.sophos.comKiteworks recommends server shutdown pending possible attack
1 article · September 24, 2026
- scworld.comKiteworks warns customers to shut down servers due to possible imminent attack
1 article · September 25, 2026
- thehackernews.comKiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack
2 articles · September 26, 2026
- therecord.mediaKiteworks urges customers to stop using platform after warning from federal intelligence agencies
1 article · September 25, 2026
Topics and entities
Topics
- Zero-Day Vulnerabilities
- Government threat intelligence sharing
- Managed File Transfer Security