@GossiTheDog@cyberplace.social on cyberplace.social
If you use KiteWorks I suggest you temporarily remove internet access now. https://www.heise.de/en/news/Imminent-Zero-Day-Attack-KiteWorks-Urges-Customers-to-Shut-Down-Servers-11466375.html
Earlier in this thread 3 posts
@GossiTheDog@cyberplace.social on cyberplace.social
Kiteworks were the artist formerly known as Accellion, who got hit by cl0p extortion group with a zero day so hard they rebranded the company.
@GossiTheDog@cyberplace.social on cyberplace.social
Shodan dork: http.favicon.hash:-1215318992
https://beta.shodan.io/search/facet?query=http.favicon.hash%3A-1215318992&facet=ssl.cert.subject.cn @shodan@mastodon.shodan.io
Conversation (8)
Open reply Open reply
Kevin Beaumont
@GossiTheDog@cyberplace.social · Sep 25
For the record - I’d shut down Kiteworks servers full stop temporarily, not for 6 hours on Saturday, until the situation becomes clear.
Chances are that law enforcement is monitoring the extortion group and knows when they plan to smash and grab. Obviously, that timing is out the window now due to the public report - the threat actor will start to smash and grab now.
Monitor the amount of outbound network traffic from Kitework boxes for very high volumes.
Open reply
Kevin Beaumont
@GossiTheDog@cyberplace.social · Sep 25
Thread reply
Some orgs have started taking their Kiteworks boxes offline
Open reply
Kevin Beaumont
@GossiTheDog@cyberplace.social · Sep 25
Thread reply
An interesting one is they’re saying Kiteworks MFT isn’t vulnerable - but it runs with Kiteworks Core, which is vulnerable.
If anybody is interested Core is a closed box Linux system, so no third party agents.
It is a bit confusing as they’re saying there’s no known vulnerability, but they’re still advising customers to switch off boxes tomorrow for 6 hours. Which is.. very strange.
I guess we wait to see what, if anything, threat actor does.
Open reply 
chronophage
@chronovore@infosec.exchange · Sep 25
Thread reply
@GossiTheDog@cyberplace.social I am just glad that the threat actors agreed to only attack the instance while it was shutdown.
Awfully decent of them.
Open reply 
Sajid Nawaz Khan 
@snkhan@infosec.exchange · Sep 25
Thread reply
@chronovore@infosec.exchange @GossiTheDog@cyberplace.social I’m struggling to understand the six hour shutdown too.
Open reply 
tehfishman
@tehfishman@ioc.exchange · Sep 25
Thread reply
@snkhan@infosec.exchange @chronovore@infosec.exchange @GossiTheDog@cyberplace.social _very_ hypothetically: it could be a supply chain attack. The systems could already be compromised, and there's a script waiting in a cron job to execute. That would explain the time window, and why they're saying there's no "vulnerability"
Open reply
Kevin Beaumont
@GossiTheDog@cyberplace.social · Sep 25
Thread reply
@tehfishman@ioc.exchange @snkhan@infosec.exchange @chronovore@infosec.exchange in theory.. but the messaging about “potential zero day” from them and law enforcement informing them suggests to me it’s actually law enforcement intercepting the threat actors comms.
Open reply
tehfishman
@tehfishman@ioc.exchange · Sep 25
Thread reply
@GossiTheDog@cyberplace.social @snkhan@infosec.exchange @chronovore@infosec.exchange Yeah I agree that's how they're making it sound. But that could be because they're incompetent.