A notable managed file transfer (MFT) provider has recently lifted a temporary shutdown directive that had been enacted for its customers. This precautionary measure was initially put in place after receiving a tip from federal intelligence authorities regarding potential threats to the system.
On September 27, Kiteworks officially announced that customers are now permitted to restore their systems to functionality. In its communication, the company emphasized, “Customers with self-hosted Advanced Forms should contact Customer Support for assistance.” It further confirmed that all systems managed by Kiteworks on behalf of its customers have been successfully brought back online and are functioning normally.
The unfolding situation stems from an unusual advisory that the MFT vendor had issued just a few days earlier, on September 25. The advisory recommended that customers take the step of shutting down their systems as a cautionary measure for a duration of nine hours. This order specifically targeted those customers who independently manage their Kiteworks systems, whether they are hosted on-premises or through cloud services like AWS and Azure. Kiteworks announced that it would also deactivate its own hosted systems during the same timeframe.
Frank Balonis, Chief Information Security Officer (CISO) at Kiteworks, explained the rationale behind this precautionary measure. “Kiteworks received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems,” he stated. “Out of an abundance of caution, we notified customers directly and recommended a precautionary shutdown window while we continue to work through the matter with federal intelligence authorities.” Balonis reassured clients by noting that there had been no confirmed reports of any breaches occurring.
He also indicated that Kiteworks had addressed all known vulnerabilities within its most recent software release, version 9.5.1, urging clients to continually update to the latest version for optimal security.
As the situation developed, speculation began to mount regarding the nature of the potential threat that had prompted this unusual response from Kiteworks. While details remain limited, online discussions suggest that a malicious actor could have been gearing up to exploit a zero-day vulnerability, a serious concern given the historical targeting of MFT platforms by cybercriminals. Notable breaches of this kind have previously involved companies such as Accellion, GoAnywhere, Cleo, and MOVEit, all of which suffered serious security incidents that underscored the risks associated with MFT solutions.
In 2023, the MOVEit campaign, particularly infamous for the involvement of the Cl0p extortion group, saw the compromise of nearly 3,000 corporate customers, resulting in significant data breaches that affected over 90 million downstream customers. Such incidents highlight the lucrative nature of MFT platforms for cybercriminals, making them attractive targets for exploitation.
John Strand, the owner of Black Hills Information Security, expressed his astonishment at the original notification from Kiteworks. “This is wild. This isn’t an active attack. People aren’t actively being breached, and yet the vendor is telling customers to take their systems offline. I’ve never heard of anything like this before,” he remarked.
Conversely, Phil Wylie, a senior consultant at Suzu Labs, pointed out that Kiteworks’ decision reflected a commendable use of threat intelligence in a proactive manner. He argued, “When credible intelligence suggests an attack may be imminent, organizations shouldn’t wait for a confirmed compromise before taking action.” Wylie recommended that security teams assess the credibility of the intelligence provided, evaluate their vulnerabilities, enhance monitoring efforts, preserve logs, ensure all systems are comprehensively patched, review privileged access, and consider temporary isolation or disabling of systems when the potential risks warrant such disruptions.
In summary, the recent actions taken by Kiteworks in response to intelligence from federal authorities demonstrate the complexities organizations face in balancing proactive security measures with ongoing operational needs. While the incident highlights potential vulnerabilities within MFT systems, it also illustrates the critical role of prompt communication and responsive actions in safeguarding customer data and maintaining system integrity in an increasingly complex cyber threat landscape.