**Kiteworks**, a prominent provider of secure file-sharing software, has advised its customers worldwide to temporarily power down their servers for a six-hour period this Saturday. This extraordinary recommendation stems from what the company describes as "credible threat intelligence" received from law enforcement, signaling an imminent cyberattack. According to German technology publication **Heise**, **Kiteworks** CISO Frank Balonis communicated directly with customers, stating, "We strongly recommend you shut down your **Kiteworks** system for six hours." The recommended shutdown windows vary by global time zone, with Central European customers advised to go offline between 4:00 a.m. and 10:00 a.m. on Saturday, September 26, and New York users from 10:00 p.m. Friday to 4:00 a.m. Saturday. Customers are urged to take systems offline even if they are not directly accessible from the internet, emphasizing the gravity of the intelligence received. ### Precautionary Measure, Not Confirmed Breach **Kiteworks** confirmed the warning, clarifying that it is a preventative measure rather than a response to a confirmed compromise. "We are not aware of any compromise of **Kiteworks** systems, and this advisory is preventative rather than a response to a confirmed breach," the company stated. They also affirmed that all known vulnerabilities are addressed in their current release, version 9.5.1. ### Zero-Day Concerns Raised Despite **Kiteworks**' official stance, **Heise** reported that **Kiteworks** customer support indicated the shutdown recommendation is specifically aimed at protecting against potential zero-day attacks. This suggests that while no specific vulnerability has been publicly confirmed or exploited, the threat intelligence points to an advanced and unknown threat. ### High-Value Targets for Cybercriminals **Kiteworks**' secure file-transfer and communications products are widely utilized by government organizations, financial institutions, and large enterprises. The sensitive nature of the data stored on such platforms makes them prime targets for cybercriminals engaging in data-theft and extortion schemes. While the specific threat actor behind this intelligence remains undisclosed, the **Clop** extortion gang has a well-documented history of targeting enterprise file-transfer platforms. Past victims include **Accellion FTA**, **GoAnywhere MFT**, **SolarWinds Serv-U FTP**, **Cleo**, and **MOVEit Transfer**. The U.S. Department of State currently offers a $10 million reward for information linking **Clop**'s activities to a foreign government.