Kiteworks has lifted its unusual advice for customers to shut down their servers after finding and fixing a critical vulnerability during the outage window, BleepingComputer reported Tuesday. The secure file-sharing company said it brought all hosted systems back online Monday and has seen no evidence that the flaw was exploited.

What Happened

Late last week, Kiteworks urged customers worldwide to take their servers offline over the weekend after federal intelligence warned of a possible imminent cyberattack.

According to BleepingComputer, Kiteworks has now identified a critical flaw in one feature that affects fewer than 1% of its customers. CyberScoop reported that the bug sits in Advanced Forms, the company's secure data-collection tool, and that roughly 50 organizations were exposed. No CVE identifier has been assigned.

RelatedCISA Orders Agencies to Fix Exploited Palo Alto Firewall and Cisco Email Gateway Flaws by Saturday

Kiteworks said it developed and deployed a fix during the shutdown, added an extra protective layer across all environments and has no indication that the vulnerability was ever exploited. It said continuous monitoring throughout the period found no abnormal activity and no sign that its own or customers' systems had been compromised. Hosted environments were restored Monday once the investigation wrapped up.

Customers who run Advanced Forms on their own infrastructure are being told to contact Kiteworks support for help. The company said its other products were not affected.

Why It Matters

Asking customers to power down production systems is a rare step for a software vendor, and it meant organizations that use Kiteworks to exchange sensitive files had to pause that work for the weekend. The company defended the decision. Chief information security officer Frank Balonis told CyberScoop that "customer data is not something we are willing to gamble with," and chief executive Jonathan Yaron said the company chose to act before having proof of an attack.

The episode also shows how threat intelligence from government agencies can reach vendors before a vulnerability is publicly known. Kiteworks has not named the group that prompted the warning but said it shared threat intelligence with Mandiant and federal authorities, CyberScoop reported.

Context

Kiteworks was formerly Accellion. In 2021, the Clop extortion gang exploited flaws in Accellion's legacy File Transfer Appliance to steal data from organizations including Qualys, Shell and the Reserve Bank of New Zealand. The company rebranded as Kiteworks in October 2021.

Managed file transfer products have remained a favorite target for data-theft groups since then, because a single compromised server can hold large volumes of sensitive documents from many business partners. Clop's 2023 mass exploitation of Progress Software's MOVEit Transfer followed the same pattern on a larger scale.

What to Watch

A CVE and technical details on the Advanced Forms flaw may follow, which would let other defenders assess their exposure. Self-hosted Advanced Forms customers still need to work with support to secure their deployments. Kiteworks has also not said whether federal agencies will publish their own guidance on the threat that triggered the shutdown.