# Kiteworks Urges Customers to Shut Down Systems After Federal Threat Intelligence Warning of Possible Zero-Day Attack

> Kiteworks (formerly Accellion), a secure file transfer and enterprise content firewall vendor, received credible threat intelligence from federal intelligence/law-enforcement authorities indicating a threat actor may attempt to target customer systems, possibly via an unknown (zero-day) vulnerability. Out of caution, Kiteworks urged all customers to execute a precautionary multi-hour shutdown window over the weekend of September 26, 2026; no compromise has been confirmed and no CVE has been assigned.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-29T14:58:21.539Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2690
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-kiteworks-federal-alert-shutdown-tl-2026-2690.webp?v=7f3171cb (Threadlinqs threat intel: Kiteworks (Accellion) Shutdown Window: Analysis & Hunting (TL-2026-2690) — Critical severity, 26 IOCs, 9 detection rules.)
- **ID:** TL-2026-2690
- **Severity:** CRITICAL
- **Category:** ZERO_DAY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (2 shown free below)

## Description

On September 25, 2026, Kiteworks Chief Information Security Officer Frank Balonis emailed the company's customer base stating that Kiteworks "received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems," and separately told customers the intelligence came from "law enforcement indicating an attack on Kiteworks systems may be imminent this weekend." The company asked every customer, regardless of whether their deployment was internet-facing, to take their Kiteworks instance offline during a designated regional window that weekend: a coordinated six-to-nine-hour window reported as 02:00-08:00 UTC / 04:00-10:00 CET / 03:00-09:00 UK time Saturday, September 26, with a separate New York window of 22:00 Friday-04:00 Saturday EDT, and additional windows spanning time zones from Australian Eastern Standard Time (AEST) to Pacific Daylight Time (PDT). Kiteworks-hosted (SaaS) customers required no action, as the vendor handled the shutdown on their behalf; self-managed customers running on-premises, AWS, or Azure deployments had to execute their own shutdown, and TechCrunch reported at least 1,000 internet-facing Kiteworks systems were identified, with one healthcare customer reporting that its immediate shutdown caused delays in patient contact. Kiteworks stated it has "no indication that Kiteworks or our customers' systems have been compromised," characterizing the advisory as preventative rather than a response to a confirmed breach, and said "all known vulnerabilities are addressed" in the current 9.5.1 release, which it urges all customers to run. As of this writing, no CVE identifier has been assigned, no technical details of the suspected vulnerability (attack vector, affected component, or exploitability) have been disclosed, the FBI declined to comment, and CISA spokesperson Marco DiSandro would not comment on the record. German outlet Heise broke the story after obtaining the warning email and confirming details by phone with Kiteworks customer support, which told the outlet: "The reason we're asking you to shut down the servers is to protect against any potential zero-day attacks." Heise also contacted Germany's BSI (Federal Office for Information Security) and BKA (Federal Criminal Police Office) for verification; neither responded immediately. Sophos Counter Threat Unit (CTU) separately issued customer guidance directing Kiteworks customers to follow the vendor's email instructions.

The advisory is notable chiefly because of Kiteworks' own history and its outsized customer base: the company traces its lineage directly to Accellion, whose legacy File Transfer Appliance (FTA), running versions 9_12_370/9_12_411 and earlier, was the subject of a catastrophic zero-day mass-exploitation campaign beginning mid-December 2020. Mandiant (FireEye) attributed the initial exploitation and web-shell deployment to a cluster it tracked as UNC2546, and the follow-on extortion activity -- emails claiming affiliation with the CLOP ransomware brand and threatening publication on a ".onion" shaming site branded "CL0P^_-LEAKS" -- to a related cluster tracked as UNC2582; Mandiant further noted limited infrastructure overlap with the financially motivated group FIN11, observing that a DEWMODE web-shell C2 IP address fell within the "Fortunix Networks L.P." netblock also historically used to host FIN11's FRIENDSPEAK command-and-control domains. UNC2546 chained four vulnerabilities -- CVE-2021-27101 (unauthenticated SQL injection via a crafted HOST header, used for initial access and to retrieve a key enabling execution of the FTA's built-in `admin.pl` utility), CVE-2021-27104 (OS command execution via a crafted POST request), CVE-2021-27102 (OS command execution via a local web service call), and CVE-2021-27103 (server-side request forgery via a crafted POST request) -- to deploy the DEWMODE web shell (installed as `/home/httpd/html/about.html` or `/home/seos/courier/about.html`), which queried the FTA's internal MySQL database for file metadata and then served encrypted download links (`/courier/about.html?dwn={encrypted path}&fn={encrypted filename}`) so operators could selectively exfiltrate files over HTTPS (port 443) to attacker-controlled IP addresses 194.88.104.24 and 45.135.229.179, sanitizing archived Apache logs afterward to remove traces. CISA, the FBI, and international partners (Australia's ACSC, the UK's NCSC, and New Zealand's CERT NZ) documented the campaign, its extortion follow-on, and confirmed impacts across federal, state, local, and private-sector victims in the US, Australia, New Zealand, Singapore, and the UK in Joint Cybersecurity Advisory AA21-055A (published Feb 24, 2021), publicly naming victims including the University of Colorado, the Washington State Auditor's Office, Flagstar Bank, Bombardier, Singtel, Shell, and Kroger. The US State Department's Rewards for Justice program has separately offered a $10 million reward for information linking Clop to a foreign government, underscoring the unresolved attribution and financial motivation behind the campaign. Accellion rebranded to Kiteworks in October 2021 as it pivoted its go-to-market around its "Private Data Network"/enterprise content firewall platform for secure file transfer, managed file transfer (MFT), enterprise webmail, and sensitive-data collaboration.

Multiple outlets covering the 2026 advisory explicitly drew the parallel to the 2020-2021 breach, as well as to subsequent Clop mass-exploitation campaigns against other managed-file-transfer products -- GoAnywhere MFT, SolarWinds Serv-U, Cleo Harmony/VLTrader/LexiCom, and MOVEit Transfer -- framing MFT/secure-file-transfer appliances broadly as a recurring target class for zero-day supply-chain-style extortion campaigns. Independent security researchers were skeptical of the unusual scale of the response: Jake Knott, a senior threat-intelligence official at watchTowr, said "nobody requests that their entire customer base unplug production systems over the weekend" absent a known CVE, patch, or technical detail, adding that "attackers' appetite for targeting [managed file transfer] appliances has not, and we have no reason to believe this time will be any different." Other researchers noted that in the absence of a published CVE, patch, or technical mitigation, full disconnection is the most reliable short-term control available against a potentially exploitable zero-day.

Kiteworks markets itself as protecting over 100 million end users across thousands of enterprises and government agencies, and holds dual U.S. FedRAMP authorization (High and Moderate impact levels), making it widely used by federal agencies, government contractors, financial institutions, healthcare organizations, legal firms, and other regulated industries in government, healthcare, technology, education, and automotive sectors. Kiteworks stated the advisory does not extend to its separately branded subsidiary products: Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder. Given Kiteworks' scale, its FedRAMP footprint, and the platform's documented history of being the target of a nation-state-adjacent, financially motivated mass zero-day campaign, this precautionary advisory is tracked as a HIGH-severity, unconfirmed/preventative threat pending either a CVE assignment, technical advisory, or confirmation (or ruling-out) of active exploitation.

## MITRE ATT&CK

- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1070.004 File Deletion
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**DEWMODE-Style Web Shell Drop and Appliance File/Database Discovery — SPL** (`TL-2026-2690-SPL-002`)

Detects file creation or modification of web-accessible script files under an MFT appliance's web root, including the specific /home/httpd/html/about.html and /home/seos/courier/about.html paths CVE-2021-27102/27103 were chained to deploy the DEWMODE web shell, which then queried the FTA's internal MySQL database for file metadata (file/directory discovery and local data collection) before serving download links. Applicable to any self-managed Kiteworks/Accellion-lineage appliance being monitored ahead of the 2026 advisory's unresolved zero-day.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1505.003, T1083, T1005
- **Data sources:** linux_audit, auditd, file_integrity_monitoring
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
(index=filesystem OR index=unix sourcetype IN ("linux_audit","auditd","fim"))
| eval dewmode_path=if(match(file_path,"(?i)(/home/httpd/html/about\.html$|/home/seos/courier/about\.html$)"),1,0)
| eval new_web_file=if(match(file_path,"(?i)\.(html|php|pl|jsp|asp)x?$") AND action IN ("created","modified"),1,0)
| where dewmode_path=1 OR new_web_file=1
| stats count min(_time) as first_seen max(_time) as last_seen values(file_path) as paths values(user) as users by host, action
| where count >= 1
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has_any ("/home/httpd/html", "/home/seos/courier", "/var/www")
| where FileName has_any (".html", ".php", ".pl", ".jsp") and (ActionType == "FileCreated" or ActionType == "FileModified")
| extend IsKnownDewmodePath = (FolderPath has_any ("/home/httpd/html", "/home/seos/courier") and FileName == "about.html")
| project Timestamp, DeviceName, FolderPath, FileName, ActionType, IsKnownDewmodePath, InitiatingProcessFileName, InitiatingProcessAccountName
| summarize EventCount = count(), Files = make_set(FileName) by DeviceName, bin(Timestamp, 1h)
```

### Sigma

```yaml
title: Web Shell File Drop on MFT/Accellion-Lineage Appliance Web Root (DEWMODE Path Pattern)
id: a1f4720d-5c60-4d7e-a08a-3d4e5f6a7b84
status: experimental
description: Detects file creation or modification of web-accessible script files under an MFT appliance's web root, including the specific /home/httpd/html/about.html and /home/seos/courier/about.html paths used by the DEWMODE web shell against Accellion FTA.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-055a
author: Threadlinqs Team
date: 2026/09/27
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.discovery
  - attack.t1083
  - attack.collection
  - attack.t1005
  - attack.tool.dewmode
logsource:
  category: file_event
  product: linux
detection:
  selection_known_path:
    TargetFilename|endswith:
      - '/home/httpd/html/about.html'
      - '/home/seos/courier/about.html'
  selection_new_web_script:
    TargetFilename|contains:
      - '/home/httpd/html/'
      - '/home/seos/courier/'
      - '/var/www/'
    TargetFilename|endswith:
      - '.html'
      - '.php'
      - '.pl'
      - '.jsp'
  condition: 1 of selection_*
falsepositives:
  - Legitimate vendor patch or upgrade process writing to the web root (e.g., the 9.5.1 update)
  - Authorized administrator content deployment
level: critical
```

**Known false positives:**

- Legitimate vendor patch or upgrade process writing to the web root (e.g., applying the 9.5.1 release)
- Authorized administrator deploying custom web content or maintenance pages

**Tuning notes:** Suppress alerts during a documented maintenance/patch window (correlate against change-management tickets) before applying this rule broadly; the two known_dewmode_path hits should page immediately regardless of window since they match a historically confirmed IOC path exactly.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- MFT Appliance Web-Layer SQL Injection & admin.pl Invocation (Accellion/Kiteworks Pattern) — KQL (locked: unlock with TL Creds)
- DEWMODE-Style Web Shell Drop and Appliance File/Database Discovery — KQL (locked: unlock with TL Creds)
- DEWMODE-Style Encrypted Download Exfiltration, Known C2 Egress & Log Tampering — KQL (locked: unlock with TL Creds)
- MFT Appliance Web-Layer SQL Injection & admin.pl Invocation (Accellion/Kiteworks Pattern) — Sigma (locked: unlock with TL Creds)
- DEWMODE-Style Web Shell Drop and Appliance File/Database Discovery — Sigma (locked: unlock with TL Creds)
- DEWMODE-Style Encrypted Download Exfiltration, Known C2 Egress & Log Tampering — Sigma (locked: unlock with TL Creds)
- MFT Appliance Web-Layer SQL Injection & admin.pl Invocation (Accellion/Kiteworks Pattern) — SPL (locked: unlock with TL Creds)
- DEWMODE-Style Encrypted Download Exfiltration, Known C2 Egress & Log Tampering — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 26)

Defanged, TLP:CLEAR.

- IP address: `194.88.104[.]24`
- IP address: `45.135.229[.]179`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Kiteworks urges customers to stop using platform after warning from federal intelligence agencies](https://therecord.media/kiteworks-urges-customers-to-stop-using-systems-incident)
- [Kiteworks urges 6-hour server shutdown over potential zero-day attacks](https://www.bleepingcomputer.com/news/security/kiteworks-urges-6-hour-server-shutdown-over-potential-zero-day-attacks/)
- [Kiteworks urges customers to shut down their servers amid 'imminent' threat of cyberattack](https://techcrunch.com/2026/09/25/kiteworks-urges-customers-to-shut-down-their-servers-amid-imminent-threat-of-cyberattack/)
- [Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack](https://thehackernews.com/2026/09/kiteworks-urges-customers-to-shut-down.html)
- [Kiteworks Issues Precautionary Shutdown Advisory for Customers Following Credible Threat Intelligence From Federal Intelligence Authorities](https://www.kiteworks.com/company/press-releases/kiteworks-precautionary-shutdown-advisory/)
- [Kiteworks recommends server shutdown pending possible attack](https://www.sophos.com/en-us/blog/kiteworks-recommends-server-shutdown-pending-possible-attack)
- [Kiteworks Warns Users to Take Systems Offline Amid Suspected Zero-Day Threat](https://gbhackers.com/kiteworks-systems-offline-amid-suspected-zero-day/)
- [Imminent Zero-Day Attack: KiteWorks Urges Customers to Shut Down Servers](https://www.heise.de/en/news/Imminent-Zero-Day-Attack-KiteWorks-Urges-Customers-to-Shut-Down-Servers-11466375.html)
- [Kiteworks warns customers to shut down servers due to possible imminent attack](https://www.scworld.com/news/kiteworks-warns-customers-to-shut-down-servers-due-to-possible-imminent-attack)
- [Exploitation of Accellion File Transfer Appliance (AA21-055A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-055a)
- [Threat Actors Exploit Accellion FTA for Data Theft and Extortion](https://www.mandiant.com/resources/blog/accellion-fta-exploited-for-data-theft-and-extortion)
- [Accellion's Brand Name is Now Kiteworks](https://www.kiteworks.com/kiteworks-news/accellions-brand-name-is-now-kiteworks/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2690