Kiteworks Urges Global Customers to Shut Down Servers for 6-9 Hours Over Federally-Warned Potential Zero-Day Targeting

Key facts

Detection coverage

As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2670 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Kiteworks Web-Shell Persistence & Post-Exploitation Account/Privilege Abuse

Detects an application-server process (IIS w3wp.exe, Java/Tomcat) spawning a command interpreter or scripting engine -- a classic web-shell indicator -- together with Windows privileged-group membership changes or Kiteworks admin-audit role/permission changes, consistent with post-exploitation persistence and privilege escalation following compromise of an internet-facing Kiteworks server.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1505.003, T1098, T1078
• Data sources: windows_security, sysmon, kiteworks_admin_audit_log
• Severity: critical
• Confidence: high

Splunk SPL

(index=win_security OR index=sysmon) sourcetype IN ("WinEventLog:Security","XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
(EventCode=1 AND (ParentImage="*\\w3wp.exe" OR ParentImage="*\\java.exe" OR ParentImage="*\\tomcat9.exe") AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe"))
OR (EventCode IN (4720,4728,4732,4756))
OR sourcetype="kiteworks:admin_audit" (action="role_change" OR action="permission_grant")
| eval technique=case(
    EventCode=1, "T1505.003 webshell_spawned_process",
    EventCode IN (4720,4728,4732,4756), "T1098 account_manipulation",
    sourcetype="kiteworks:admin_audit", "T1078 valid_account_privilege_change")
| stats count values(technique) as mitre_techniques by host, user, _time
| where count > 0

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe","java.exe","tomcat9.exe")
| where FileName in~ ("cmd.exe","powershell.exe","wscript.exe","cscript.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| union (
    AuditLogs
    | where TimeGenerated > ago(24h)
    | where OperationName in ("Add member to role","Add app role assignment to service principal","Update user")
    | project Timestamp = TimeGenerated, DeviceName = tostring(""), InitiatingProcessFileName = tostring("kiteworks_admin_audit"), FileName = OperationName, ProcessCommandLine = tostring(TargetResources), AccountName = tostring(InitiatedBy.user.userPrincipalName)
)
| summarize EventCount = count() by AccountName, DeviceName, bin(Timestamp, 1h)
| where EventCount > 0

Sigma

title: Command Interpreter Spawned by Kiteworks Application-Server Process
id: 5b7c8d9e-2f30-4142-9536-7b8c9d0e1f20
status: experimental
description: Detects w3wp.exe/java.exe/tomcat9.exe spawning cmd.exe, powershell.exe, wscript.exe, or cscript.exe — a web-shell persistence indicator.
references:
    - https://attack.mitre.org/techniques/T1505/003/
author: Threadlinqs Team
date: 2026-09-26
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.privilege-escalation
    - attack.t1098
    - attack.defense-evasion
    - attack.t1078
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\java.exe'
            - '\tomcat9.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate app-server maintenance scripts
    - Scheduled backup/health-check jobs
level: high

Known false positives:

• Legitimate Kiteworks maintenance/patch scripts invoked by the app-server service account
• Scheduled backup jobs or health-check scripts launched from the app-server process

Tuning notes: Exclude the known service-account SID used for scheduled Kiteworks maintenance; correlate EventCode 4720/4728/4732/4756 with change-management tickets before alerting.

• 🔒 Phishing-Delivered Script Execution Preceding Kiteworks Exploitation Attempt · unlock with TL Creds
• 🔒 Session-Token Reuse Across Multiple IPs Followed by Role/Privilege Change (AiTM Indicator) · unlock with TL Creds
• 🔒 Anomalous Cloud-App Bulk Download from Kiteworks Consistent with Mass Exfiltration · unlock with TL Creds
• 🔒 Kiteworks Secure Data Forms Exploit Attempt / Vulnerability Scan Pattern · unlock with TL Creds
• 🔒 Web-Shell-Style Child Process Spawned by Kiteworks Application Server · unlock with TL Creds
• 🔒 Sustained Large-Volume Outbound Transfer from MFT Host (Bulk Exfiltration Pattern) · unlock with TL Creds
• 🔒 Kiteworks Public-Facing Exploitation & Pre-Attack Vulnerability Scanning · unlock with TL Creds
• 🔒 Kiteworks Bulk File-Transfer Egress Consistent with Cl0p Mass-Exfiltration Playbook · unlock with TL Creds

Indicators of compromise

As of 2026-09-25, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-2670.

Technical analysis

Kiteworks says it has found no evidence of any actual compromise, no CVE has been assigned, and the current release (9.5.1) addresses all previously known vulnerabilities.

On September 25, 2026, Kiteworks CISO Frank Balonis emailed customers stating the company had received 'credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems,' and that the company had 'no indication that Kiteworks or our customers' systems have been compromised' -- characterizing the guidance explicitly as preventative rather than a response to a confirmed breach. The advisory, first reported by German outlet Heise and then confirmed directly to BleepingComputer, instructed customers to take their Kiteworks deployments offline during a regional window (e.g., 04:00-10:00 CET / 22:00 Fri-04:00 EDT in New York), spanning time zones from Australian Eastern Standard Time to Pacific Daylight Time. Kiteworks explicitly told customers to shut down even systems that are not directly internet-exposed, stating 'potential access paths' could not be ruled out. Self-managed customers (on-premises, AWS, or Azure) were told to perform the shutdown themselves; Kiteworks said it would shut down its own hosted customer instances on their behalf. The company's own press release confirmed its acquired subsidiary products -- Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder -- are not affected by the advisory, implying the concern is scoped to the core Kiteworks platform (Secure File Sharing, Managed File Transfer, Email Protection, Secure Data Forms/Private Data Network, and Sensitive Content Communications). No CVE identifier, exploitation technique, affected component, or IOC was disclosed publicly. TechCrunch reported that CISA spokesperson Marco DiSandro declined to comment on the record and that the FBI also declined to comment when asked about the alert, and cited security researcher Kevin Beaumont's estimate of roughly 1,000 internet-facing Kiteworks instances (likely an undercount of total deployments). Multiple outlets noted this advisory lands against the backdrop of a well-documented pattern: Kiteworks' predecessor product, Accellion FTA, was mass-exploited via multiple zero-days by the Cl0p extortion actor (tracked as UNC2546) in December 2020-January 2021, and Cl0p has since repeated the same MFT zero-day extortion playbook against Fortra GoAnywhere (CVE-2023-0669, Feb 2023), Cleo Harmony/VLTrader/LexiCom (CVE-2024-55956, Dec 2024), and Oracle E-Business Suite (CVE-2025-61882, late 2025) -- none of which is confirmed to be connected to this advisory. Separately, Kiteworks itself disclosed and patched four vulnerabilities in its Secure Data Forms and Core components earlier in 2026: CVE-2026-23514 (Core access-control bypass, CVSS 8.8, fixed in 9.2.2), CVE-2026-23635 (Secure Data Forms unprotected credential transport, CVSS 6.5, fixed in 9.2.1), CVE-2026-24752 (Secure Data Forms reflected XSS, CVSS 8.2, fixed in 9.3.0), and CVE-2026-24753 (Secure Data Forms IDOR/authorization bypass, CVSS 6.5, fixed in 9.3.0). Kiteworks states the current 9.5.1 release addresses all of these; none is confirmed as the subject of the September 2026 shutdown advisory. Customer guidance issued alongside the shutdown included preserving authentication, application, web-server, endpoint, and network logs before restart; restricting administrative access; and reviewing for unusual file-transfer activity, unexpected authentication events, and unexplained privilege changes after systems come back online.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Credential Access

T1040 Network Sniffing; T1557 Adversary-in-the-Middle

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

Execution

T1059.007 JavaScript

Defense Evasion

T1078 Valid Accounts

Privilege Escalation

T1098 Account Manipulation

Initial Access

T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link

Persistence

T1505.003 Web Shell

Impact

T1565.001 Stored Data Manipulation; T1657 Financial Theft

Resource Development

T1588.005 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

• Kiteworks platform 9.5.1 (current release; vendor states it addresses all previously known vulnerabilities, including CVE-2026-23514, CVE-2026-23635, CVE-2026-24752, and CVE-2026-24753)

Immediate actions

• Complete the vendor-directed regional shutdown window and confirm restart only after the window closes
• Preserve authentication, application, web-server, endpoint, and network logs prior to shutdown and after restart
• Upgrade all Kiteworks deployments to version 9.5.1 or later before bringing systems back online
• After restart, review logs for unusual file-transfer activity, unexpected authentication events, and unexplained privilege or role changes
• Restrict administrative access to Kiteworks management interfaces during and immediately after the window
• Shut down Kiteworks systems even if they are not directly internet-exposed, per vendor guidance that alternate access paths could not be ruled out

Workarounds

• Perform the vendor-specified 6-9 hour precautionary shutdown even for systems not directly reachable from the internet
• Self-managed customers (on-premises, AWS, or Azure) must execute the shutdown themselves; Kiteworks-hosted customers have it performed on their behalf and require no customer action

Longer-term hardening

• Treat internet-facing managed file transfer (MFT) and secure file-sharing platforms as high-value zero-day targets given the repeated pattern (Accellion FTA, MOVEit, GoAnywhere, Cleo, Oracle EBS) and prioritize rapid patch SLAs for them
• Segment MFT/secure file-sharing infrastructure from the broader internal network to limit blast radius from a future zero-day
• Deploy behavioral monitoring/EDR around MFT platforms specifically tuned for anomalous file-transfer volume, authentication anomalies, and privilege changes
• Subscribe to the Kiteworks GitHub security-advisories feed and vendor Trust Center for real-time patch/advisory notifications
• Reduce unnecessary internet exposure of MFT admin interfaces; Kevin Beaumont's census of ~1,000 internet-facing Kiteworks instances underscores the available attack surface

Affected and fixed versions

• Kiteworks — Kiteworks Platform (Secure File Sharing, Managed File Transfer, Email Protection, Secure Data Forms / Private Data Network, Sensitive Content Communications)
  Vulnerable versions: Unspecified / unconfirmed - no affected component or version disclosed for the September 2026 advisory itself
  Fixed in: 9.5.1 (vendor-recommended current release)
• Kiteworks — Kiteworks Core
  Vulnerable versions: 9.2.0; 9.2.1
  Fixed in: 9.2.2 (CVE-2026-23514)
• Kiteworks — Kiteworks Secure Data Forms
  Vulnerable versions: prior to 9.2.1 (CVE-2026-23635); prior to 9.3.0 (CVE-2026-24752, CVE-2026-24753)
  Fixed in: 9.2.1; 9.3.0
• Kiteworks — Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, 123FormBuilder (Kiteworks-owned subsidiary products)
  Fixed in: Not applicable - vendor explicitly confirmed these are not affected by this advisory

Timeline

• 2020-12-01 Cl0p (tracked as UNC2546) begins mass-exploiting multiple zero-day vulnerabilities in Accellion FTA - Kiteworks' predecessor product - in a campaign that continued into January 2021 and is cited by multiple outlets as the historical precedent for this advisory.
• 2026-03-25 CVE-2026-23514, an access-control bypass in Kiteworks Core (CVSS 8.8) allowing authenticated users to view unauthorized content, is published; fixed in Kiteworks Core 9.2.2.
• 2026-03-27 CVE-2026-23635, an unprotected-credential-transport flaw in Kiteworks Secure Data Forms (CVSS 6.5), is published; fixed in version 9.2.1.
• 2026-06-01 CVE-2026-24752 (reflected XSS, CVSS 8.2) and CVE-2026-24753 (IDOR/authorization bypass) in Kiteworks Secure Data Forms are published; both fixed in version 9.3.0.
• 2026-09-25 TechCrunch reports that CISA spokesperson Marco DiSandro and the FBI both declined to comment on the record about the threat alert to Kiteworks.
• 2026-09-25 Kiteworks publishes an official press release confirming current release 9.5.1 addresses all known vulnerabilities and that subsidiary products (Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, 123FormBuilder) are not affected.
• 2026-09-25 Kiteworks CISO Frank Balonis emails customers stating the company received credible threat intelligence from federal intelligence/law-enforcement authorities that a threat actor may attempt to target Kiteworks systems, and schedules a precautionary shutdown window.
• 2026-09-25 German outlet Heise first reports that Kiteworks is telling customers to shut down systems over a possible zero-day; Kiteworks confirms the advisory directly to BleepingComputer.
• 2026-09-26 The coordinated 6-9 hour precautionary shutdown window executes globally (e.g., 04:00-10:00 CET in Central Europe, 22:00 Fri-04:00 EDT in New York), spanning time zones from Australian Eastern Standard Time to Pacific Daylight Time.

Sources cited

• NVD - CVE-2026-24752 (Kiteworks Secure Data Forms reflected XSS) NVD (NIST) · Advisory · 2026-06-01
• Kiteworks Issues Precautionary Shutdown Advisory for Customers Following Credible Threat Intelligence From Federal Intelligence Authorities kiteworks.com · Vendor report · 2026-09-25
• CVE-2026-24753 detail - Kiteworks Secure Data Forms Authorization Bypass cvefeed.io · Research · 2026-06-01
• CVE-2026-23635 - Kiteworks Information Disclosure Flaw SentinelOne · Research · 2026-03-27
• GHSA-qmv7-28g4-hx9x - Kiteworks Secure Data Forms IDOR (CVE-2026-24753) GitHub · Code repository · 2026-06-01
• GHSA-9hw2-6qp4-3v8f - Kiteworks Secure Data Forms unprotected credential transport (CVE-2026-23635) GitHub · Code repository · 2026-03-27
• Kiteworks Core Access Control Vulnerability (CVE-2026-23514) thehackerwire.com · Blog · 2026-03-25
• Kiteworks urges 6-hour server shutdown over potential zero-day attacks BleepingComputer · News · 2026-09-25
• Kiteworks urges customers to shut down their servers amid 'imminent' threat of cyberattack techcrunch.com · News · 2026-09-25
• Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack The Hacker News · News · 2026-09-26
• Kiteworks zero-day warning prompts shutdown advice cybernews.com · News · 2026-09-25
• Kiteworks Warns Users to Take Systems Offline Amid Suspected Zero-Day Threat gbhackers.com · News · 2026-09-25
• Kiteworks Customers Told to Shut Down Servers Over Possible Zero-Day Attack cyberpress.org · News · 2026-09-25

More in zero day

• Autonomous AI Agent Sandbox Escape via JFrog Artifactory Zero-Days and Hugging Face Dataset Pipeline Intrusion (OpenAI ExploitGym Incident)
• Citrix NetScaler ADC/Gateway Zero-Day CVE-2026-88779 ("PitScaler 2") Exploited Against Appliances Patched Days Earlier (CISA KEV)
• Vercel Confirms KVM Zero-Day Guest-to-Host VM Escape (Root on Host) via Sandbox Bug Bounty; $50,000 Bounty Awarded
• Fortinet FortiMail critical path traversal flaw CVE-2026-104286 (FG-IR-26-175) exploited in zero-day attacks
• Kiteworks Urges Customers to Shut Down Systems After Federal Threat Intelligence Warning of Possible Zero-Day Attack

Previous and next in zero day

• Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF Viewer in Operation Dream Job Against Defense Industry Previous report
• Kiteworks Urges Customers to Take Systems Offline Amid Suspected Zero-Day Threat Next report