Cybersecurity
Kiteworks urges nine-hour shutdown over possible attack
Kiteworks told customers to take systems offline for nine hours over the weekend after receiving intelligence from federal authorities, while saying it had found no evidence of compromise.
- Kiteworks asked customers to shut down systems for nine hours over the weekend after receiving threat intelligence from federal intelligence authorities.
- Frank Balonis said the company had notified customers directly and recommended the shutdown while it worked with the authorities.
- Kiteworks said it had found no evidence that customer systems were compromised and described the advisory as preventative.
- The company said version 9.5.1 addressed known vulnerabilities and told customers to apply the patches.
- Kiteworks said its subsidiaries Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai and 123FormBuilder were not affected.
Kiteworks told customers to shut down their systems for nine hours over the weekend after it received threat intelligence from federal intelligence authorities that suggested a threat actor might target some of its systems. Frank Balonis, the company’s chief information security officer, said customers were notified directly.
The company said it had not found evidence that customer systems were compromised. It said the advisory was intended as a precaution while it continued to work with the authorities, and it did not identify the agency or name any suspected attacker.
Kiteworks said all known vulnerabilities had been fixed in its latest release, version 9.5.1, and advised customers to install the patches. It also said its subsidiaries Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai and 123FormBuilder were not affected.
The article noted that in late 2020 and early 2021 Clop, also known as UNC2546, exploited multiple zero-day flaws in Kiteworks’s file transfer programme in a data theft and extortion campaign against high-profile entities.
Named in this story
People
- Frank Balonis
- the Kiteworks CISO who delivered the warning
Companies
- Kiteworks
- urged customers to shut down systems and said no compromise had been found
- Accellion
- former name of Kiteworks
- Zivver
- one of the Kiteworks subsidiaries said to be unaffected
- DRACOON
- one of the Kiteworks subsidiaries said to be unaffected
- totemo
- one of the Kiteworks subsidiaries said to be unaffected
- ownCloud
- one of the Kiteworks subsidiaries said to be unaffected
- WAMNET
- one of the Kiteworks subsidiaries said to be unaffected
- Maytech
- one of the Kiteworks subsidiaries said to be unaffected
- Bonfy.ai
- one of the Kiteworks subsidiaries said to be unaffected
- 123FormBuilder
- one of the Kiteworks subsidiaries said to be unaffected
Organisations
- Clop
- the threat actor named in the past campaign against the file transfer programme
- UNC2546
- the alias given for Clop in the earlier campaign
Governments and agencies
- federal intelligence authorities
- provided the threat intelligence cited by Kiteworks
How the source tells it
The article read like a precautionary security notice, with urgency from the shutdown warning and reassurance from repeated denials of compromise.
- urgency the nine-hour shutdown request and the framing of a likely near-term attack
- reassurance the repeated statement that no compromise had been found and that the advisory was preventive