# Kiteworks Urges Customers to Take Systems Offline Amid Suspected Zero-Day Threat

> Secure file-sharing and managed content communications provider Kiteworks issued an emergency advisory urging customers worldwide to take Kiteworks systems offline for a coordinated precautionary window (roughly 02:00-08:00 UTC / 04:00-10:00 CET, September 26, 2026) after receiving credible threat intelligence from federal law-enforcement authorities indicating a threat actor may attempt to target Kiteworks deployments. CISO Frank Balonis and the company stressed the advisory is preventive and does not confirm any actual compromise; no CVE, exploited vulnerability, or threat actor has been publicly identified, and the company says all currently known vulnerabilities are addressed in its 9.5.1 release.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-29T15:26:34.305Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2702
- **ID:** TL-2026-2702
- **Severity:** CRITICAL
- **Category:** ZERO_DAY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On September 25, 2026, Kiteworks CISO Frank Balonis emailed customers worldwide stating the company had "received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems for customers," and recommended a coordinated precautionary shutdown window that weekend. Self-managed customers (on-premises, AWS, or Azure deployments) were told to power down their own Kiteworks systems for the window; Kiteworks-hosted customers required no action, as the vendor handled the shutdown on their behalf. Reported windows varied by outlet: Kiteworks' own guidance framed it as roughly six hours (02:00-08:00 UTC / 04:00-10:00 CET on Saturday, September 26; 10:00 p.m. Friday-4:00 a.m. Saturday in New York), while the company's own press release and a second wave of press coverage described a nine-hour precautionary window spanning zones from Australian Eastern Standard Time through Pacific Daylight Time. The company explicitly stated: "We have no indication that Kiteworks or our customers' systems have been compromised, so this advisory is preventative rather than a response to a confirmed breach" and said the potential activity "may involve an unknown zero-day vulnerability."

No CVE identifier, exploitation technique, or affected component has been publicly disclosed. Kiteworks said "all known vulnerabilities are addressed in our current release, 9.5.1," and recommended all customers run the latest version. Guidance issued alongside the shutdown asked customers to preserve authentication, application, web-server, endpoint, and network logs before restarting; restrict administrative access; monitor for unusual authentication or admin activity; and, per follow-on legal/compliance guidance, keep systems offline through at least September 28, 2026 rather than restoring service purely because the initial window had lapsed. Kiteworks named several subsidiaries/brands as unaffected by the advisory: Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder.

The advisory drew immediate comparison to Kiteworks' own corporate history and to a recurring pattern of zero-day exploitation against managed-file-transfer (MFT) and secure-content-collaboration platforms — a pattern press coverage explicitly cited as the reason the shutdown was treated as credible rather than as an overreaction. Kiteworks was formerly Accellion, whose legacy File Transfer Appliance (FTA) was hit starting mid-December 2020 by a threat cluster Mandiant tracks as UNC2546 (closely tied to the CL0P extortion brand, TA505/FIN11/Lace Tempest/Gold Tahoe). UNC2546 exploited an SQL-injection zero-day as its primary intrusion vector against FTA and installed the DEWMODE web shell, which queried the FTA's backend MySQL database to enumerate available files (file ID, path, filename, uploader, recipient) for bulk download, then ran a cleanup routine — passing a specific csrftoken query parameter to DEWMODE — to remove its activity traces. Starting in late January 2021, victims began receiving extortion emails from a follow-on cluster Mandiant tracks separately as UNC2582, threatening to publish stolen data on the "CL0P^_- LEAKS" .onion site; victims included the University of Colorado, the Washington State Auditor's Office, Flagstar Bank, Bombardier, and Kroger.

The same actor lineage subsequently exploited CVE-2023-0669 (Fortra GoAnywhere MFT, a deserialization zero-day exploited from January 2023, ~130 claimed victims), CVE-2023-34362 (Progress MOVEit Transfer, a SQL-injection zero-day mass-exploited from May 27, 2023). Per CISA advisory AA23-158A, MOVEit intrusions deployed the LEMURLOOT C# ASP.NET web shell — originally deployed as human2.aspx to masquerade as the legitimate human.aspx, authenticated via a hard-coded password passed in the X-siLock-Comment HTTP header, and capable of retrieving Azure Blob Storage settings, enumerating databases, creating/deleting admin accounts, and exfiltrating files — against more than 2,500 organizations. Most recently, CL0P exploited a bypass of the original patch for CVE-2024-50623 (Cleo Harmony/VLTrader/LexiCom, unrestricted file upload/download enabling unauthenticated RCE, actively exploited from early December 2024). Per Rapid7's incident-response reporting on that campaign, attackers wrote malicious files into Cleo's default "Autorun" processing directory to gain code execution, then used either a Java-based RAT or a PowerShell-based AES shellcode loader to spawn further payloads — including, in observed intrusions, Cobalt Strike beacons retrieved from attacker infrastructure — before running Windows discovery commands (systeminfo, whoami, net group /domain, nltest /domain_trusts, wmic logicaldisk) and, in at least one documented case, an Overpass-the-Hash attack using captured NTLM hashes to obtain Kerberos tickets for further access; scripts observed in the intrusions were capable of clearing Windows event logs when run with administrative privileges.

Reaction to the Kiteworks advisory itself was mixed: watchTowr's Jake Knott publicly questioned the lack of technical disclosure, stating "There is no known CVE, patch, or additional technical details available – but nobody requests that their entire customer base unplug production systems over the weekend because of a hunch," and asked what the vulnerability was, what it impacted, how it was exploited, and whether "'turn it off and leave it off' officially become a security control." The FBI declined to comment when asked, and a CISA spokesperson would not comment on record. Legal/compliance guidance (Morgan Lewis) advised affected organizations — noting Kiteworks' use across technology, healthcare, and retail/e-commerce sectors, in addition to the government and financial-services customers cited in the original hunt rationale — to coordinate cybersecurity, legal, privacy, compliance, business-continuity, and communications stakeholders proactively, inventory sensitive data accessible through Kiteworks environments, and review logs for anomalous authentication, administrative activity, unexpected transfers, or newly created accounts/tokens before restoring service. As of this writing, no public confirmation of an actual attempted or successful attack against Kiteworks has emerged, and no CVE tied to the September 2026 advisory has been published.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.001 PowerShell
- T1505.003 Web Shell
- T1027 Obfuscated Files or Information
- T1685.005 Clear Windows Event Logs
- T1018 Remote System Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1482 Domain Trust Discovery
- T1069.002 Domain Groups
- T1550.002 Pass the Hash
- T1071 Application Layer Protocol
- T1657 Financial Theft

## Sources

- [Kiteworks Warns Users to Take Systems Offline Amid Suspected Zero-Day Threat](https://gbhackers.com/kiteworks-systems-offline-amid-suspected-zero-day/)
- [Kiteworks urges 6-hour server shutdown over potential zero-day attacks](https://www.bleepingcomputer.com/news/security/kiteworks-urges-6-hour-server-shutdown-over-potential-zero-day-attacks/)
- [Kiteworks urges customers to shut down their servers amid 'imminent' threat of cyberattack](https://techcrunch.com/2026/09/25/kiteworks-urges-customers-to-shut-down-their-servers-amid-imminent-threat-of-cyberattack/)
- [Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack](https://thehackernews.com/2026/09/kiteworks-urges-customers-to-shut-down.html)
- [Kiteworks urges customers to stop using platform after warning from federal intelligence agencies](https://therecord.media/kiteworks-urges-customers-to-stop-using-systems-incident)
- [Kiteworks Issues Precautionary Shutdown Advisory for Customers Following Credible Threat Intelligence From Federal Intelligence Authorities](https://www.kiteworks.com/company/press-releases/kiteworks-precautionary-shutdown-advisory/)
- [Kiteworks Warns of Imminent Cyber Threat, Urges Customers to Shut Down Systems](https://www.morganlewis.com/pubs/2026/09/kiteworks-warns-of-imminent-cyber-threat-urges-customers-to-shut-down-systems)
- [#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a)
- [Widespread Exploitation of Cleo File Transfer Software (CVE-2024-50623)](https://www.rapid7.com/blog/post/2024/12/10/etr-widespread-exploitation-of-cleo-file-transfer-software-cve-2024-50623/)
- [Kiteworks Zero-Day Threat Intelligence Shutdown 2026 - Cybersecurity Analysis](https://aviatrix.ai/threat-research-center/kiteworks-zero-day-threat-intelligence-shutdown-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2702