Kiteworks Urges Immediate Shutdown of MFT Servers Over Zero-Day Threat Kiteworks, a provider of secure managed file transfer (MFT) solutions, has instructed users to power down their servers worldwide following warnings of an imminent cyberattack exploiting an undisclosed zero-day vulnerability. The directive, first reported by German outlet Heise, applies for a six-hour window on Saturday, September 26, from 3 AM to 9 AM UK time, though the company recommends shutting systems down beforehand. In an email to customers, Kiteworks CISO Frank Balonis cited "credible threat intelligence from law enforcement" indicating a potential attack this weekend. While no compromise of Kiteworks services has been confirmed, the move was described as a precautionary measure. The vulnerability has yet to receive a CVE designation, and no technical details such as attack vectors or affected components have been disclosed. Security experts have raised concerns over the unusual request. Jake Knott, Head of Threat Intelligence at Watchtowr, noted that demanding a full shutdown of production systems without a patch or public CVE is highly irregular. Managed file transfer appliances remain prime targets for threat actors, offering both initial access and direct exposure to sensitive data for extortion or lateral movement. Knott warned that such vulnerabilities often transition from targeted to widespread exploitation rapidly, with attackers and researchers likely already analyzing the codebase. The advisory’s lack of specificity including why even non-internet-facing systems must be powered off has sparked further questions. While Kiteworks’ customers are advised to comply, the public disclosure of the zero-day may temporarily deter attackers, though the long-term risk remains unclear. The incident underscores the persistent targeting of MFT solutions in software supply chain attacks.

A survey by Kiteworks revealed that energy and utilities sector organizations—identified as the highest-risk group—face severe blind spots in breach tracking, third-party visibility, and AI governance. 24% of firms with 1,001–5,000 third parties experience at least seven breaches annually, with 46% reporting the highest supply chain risk and 42% taking 31–90 days to detect breaches. Slow detection correlates with litigation costs exceeding $3 million for over 75% of entities with 10+ hacks yearly. The sector’s lack of AI governance (only 17% with full frameworks) and 36% of uncertain AI users deploying no privacy-enhancing technologies exacerbate risks. Regional disparities (e.g., Middle East’s zero 24-hour detection, APAC’s 35% inability to assess AI risks) compound the crisis. The cumulative effect includes missed compliance demonstrations, cascading financial/reputational damage, and operational disruptions—threatening critical infrastructure reliability and public safety. The survey underscores how visibility gaps directly enable high-impact breaches, with energy/utilities facing systemic vulnerabilities due to unmonitored third-party ecosystems and AI exposures.