Kiteworks Patches Critical Flaw and Lifts Customer Shutdown Advisory

Summary

Kiteworks patched a critical flaw in a feature used by fewer than 1% of customers, lifted its precautionary shutdown advisory, and restored hosted systems after finding no evidence of compromise or exploitation.

Key points

Kiteworks urged customers to shut down systems after receiving a federal intelligence warning of a potentially imminent attack.
The company restored hosted customer systems and lifted the advisory after monitoring found no signs of compromise or suspicious activity.
Kiteworks patched a critical vulnerability in a feature used by fewer than 1% of customers and added a protective layer across environments.
The vulnerability has no assigned CVE, and Kiteworks said it had no indication the flaw was exploited; other Kiteworks products were unaffected.
Self-hosted users of Kiteworks Advanced Forms were advised to contact support for assistance.
Shadowserver observed nearly 400 internet-accessible Kiteworks instances but did not report how many were honeypots or had been patched. The article notes Clop previously targeted legacy Accellion file-transfer software.

Article Details

Severity: Critical
Exploitation Status: not_reported
Exploit Availability: unknown
Patch Status: available
Workarounds: Customers with self-hosted Kiteworks Advanced Forms were advised to contact support for further assistance.

Threat Actors

ClopExtortion gang that previously targeted legacy Accellion File Transfer Appliance software in zero-day attacks.

Vendors

KiteworksKiteworks lifted its precautionary shutdown advisory after patching a critical vulnerability and finding no signs that any customer or company systems were compromised.

Products

Accellion FTAhacking campaign led to a stream of data breaches impacting many high-profile entities that used the Accellion FTA software to transfer sensitive files, including cybersecurity firm Qualys, energy giant Shell, the Kiteworks Advanced FormsKiteworks has also patched a critical vulnerability in an unnamed feature used by less than 1% of all customers and advised those with self-hosted Kiteworks Advanced Forms to contact support for further assistance.Kiteworks File Transfer Applianceof exploiting vulnerabilities in enterprise file-sharing platforms, also targeted a legacy Kiteworks File Transfer Appliance (FTA) software in zero-day attacks when the company was still known as Accellion.Kiteworks Private Content NetworkFormerly known as Accellion, it operates a Private Content Network (PCN) that integrates enterprise email, file sharing, Managed File Transfer (MFT), APIs, and web forms into a single platform.