• Kiteworks warned customers of a “credible” planned cyberattack, urging a nine‑hour precautionary shutdown
• No breaches reported; advisory lifted Sept 27, systems restored, version 9.5.1 deemed secure
• Context recalls Cl0p’s past file‑sharing platform hits, raising speculation about possible resurgence

Secure file sharing company Kiteworks recently told its customers to shut down their servers for nine hours, in anticipation of an incoming cyberattack.

There are no reports of actual attacks – at least not yet, but in a blog post, the company revealed it had received “credible” threat intelligence from federal authorities warning them of a planned attack against the company and its customers.

In response, the company told its customers to shut down their servers for nine hours, depending on their timezone.

What happened?

“Kiteworks is advising customers to facilitate a nine-hour precautionary shutdown window this weekend, in their local time zone,” the announcement reads.

“Customers who self-manage their Kiteworks systems—on-premises or on AWS or Azure—should shut down those systems themselves during this window. Kiteworks will shut down the customer systems it hosts, on behalf of customers, during the same window, so Kiteworks-hosted customers are not required to take any action.”

In the announcement, the company’s Chief Information Security Officer, Frank Balonis, said the measure is proactive rather than reactive, and that there are no ongoing attacks just yet:

“Out of an abundance of caution, we notified customers directly and recommended a precautionary shutdown window while we continue to work through the matter with federal intelligence authorities,” Balonis said.

“We have no indication that Kiteworks or our customers’ systems have been compromised, so this advisory is preventative rather than a response to a confirmed breach.”

Citing German media, BleepingComputer said the shutdown window “applies to customer worldwide”, with affected time zones ranging from Australian Eastern Standard Time, to Pacific Daylight Time. In Central Europe, customers were told to shut down between 4 and 10 AM on Saturday. On the east coast of the US, the shutdown window is between 10PM on a Friday, until 4AM on Saturday.

Who could be gearing up for an assault?

Kiteworks is a US-based enterprise security and secure data-sharing platform, which organizations can use to manage sensitive information, especially when ordinary email attachments or consumer file-sharing services aren’t considered secure enough.

Kiteworks says it does not have any fixes in the pipeline and that all known vulnerabilities are accounted for in the latest version 9.5.1. Obviously, customers are advised to run this version instead of older, potentially vulnerable ones, and were told that other subsidiaries such as Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder, were not affected.

Secure data-sharing platforms are an attractive target for cybercriminals, given the high-value organizations that use them, as well as the sensitive information they handle. We don’t know who the attackers might be, but there are some strange coincidences occurring at the moment.

Three years ago, a hacking group known as Cl0p struck two major file-sharing platforms: GoAnywhere MFT and MOVEit. The breaches ended up becoming some of the biggest hits in recent history, affecting thousands of customers. Victims ranged from government agencies, schools and healthcare, to major firms like Sony and PricewaterhouseCoopers (PwC).

Cl0p tried to extort many of these companies, even succeeding with some. The cybersecurity community tried to estimate how much money the group stole this way, and the general consensus seems to be anywhere between $40 and $100 million.

In the months and years following these two incidents, Cl0p vanished. The group was no longer making high-level plays, and we’ve not reported on any major breaches since. Until last week, that is, when it was reported that ShinyHunters – currently one of the most active and dangerous data exfiltration organizations around – attacked Cl0p.

ShinyHunters leaked plenty of Cl0p’s sensitive data, saying it did so in retaliation for threats of doxxing and physical violence made by the group. We don’t know if Cl0p was preparing to hit Kiteworks, but we wouldn’t be too surprised if it was an attempted brand management after being somewhat embarrassed by ShinyHunters.

So far, there were no reports of actual breaches at any of Kiteworks’ customers, but we’re continuing to monitor the situation.

The company said that as of September 27 2026, the shutdown recommendation has been lifted for all customers. “If you have not already restarted, you may bring your Kiteworks system back online. Customers with self-hosted Advanced Forms should contact Customer Support for assistance. All systems Kiteworks hosts on customers’ behalf have been brought back up and are operating normally.”