Cybersecurity
Kiteworks lifts shutdown advisory after patching flaw
Kiteworks ended a precautionary shutdown order, said it had found no sign of compromise, and said it had patched a critical flaw in an unnamed feature used by fewer than 1% of customers.
- Kiteworks told customers on Saturday to shut down their servers after federal intelligence authorities warned of a possible imminent cyberattack.
- On Monday, the company said hosted customer systems were back online and that it had found no evidence of compromise.
- Kiteworks said it had patched a critical vulnerability in an unnamed feature used by less than 1% of customers and told self-hosted Kiteworks Advanced Forms users to contact support.
- Shadowserver said it had seen nearly 400 Kiteworks instances exposed on the internet, including 234 in the United States, but could not tell how many were honeypots or already fixed.
- The company said the shutdown recommendation was lifted on 27 September and that the flaw had not yet been given a CVE identifier.
Kiteworks told customers to power down their servers on Saturday after federal intelligence authorities warned that a cyberattack might be close. The company later said it had done so as a precaution.
By Monday, Kiteworks said hosted customer systems were back online. It said its checks had found no sign that any Kiteworks system or customer system had been compromised.
Kiteworks also said it had fixed a critical vulnerability in an unnamed feature used by fewer than 1% of customers. It said the issue had not been assigned a CVE number, and it told users of self-hosted Kiteworks Advanced Forms to contact support.
Shadowserver said it had found almost 400 Kiteworks instances reachable from the internet, with 234 in the United States, but it gave no breakdown of which were honeypots or already patched. The article also noted that Clop had previously targeted Accellion’s legacy file-transfer software, and that Five Eyes had issued a joint advisory about those attacks in February 2021.
Named in this story
Companies
- Kiteworks
- lifted the shutdown advisory and patched the flaw
- Accellion
- the former name of Kiteworks and maker of the legacy FTA software
Organisations
- Shadowserver
- reported nearly 400 internet-facing Kiteworks instances
- Clop extortion gang
- previously targeted Accellion’s legacy file-transfer software in zero-day attacks
- Five Eyes
- issued a joint security advisory about the earlier attacks
Products and systems
- Kiteworks Advanced Forms
- the self-hosted product whose users were told to contact support
How the source tells it
Mostly neutral reporting, with a brief urgent frame around the precautionary shutdown and restart.
- urgency A temporary shutdown and later restart were driven by a warning of a possible imminent attack.