Security Flaw in TeleMessage App Prompts Hacker Activity Surge
A critical security vulnerability tracked as CVE-2025-48927 in the TeleMessage communication app is currently under active reconnaissance and exploitation attempts, according to a new report from cybersecurity intelligence firm GreyNoise.
Since April, at least 11 IP addresses have directly attempted to exploit the flaw, while over 2,000 additional IPs appear to be engaged in ongoing reconnaissance activities, seeking potential openings in related systems.
Legacy Endpoint in Spring Boot Actuator Creates Critical Risk
The root of the vulnerability lies in Spring Boot Actuator, a Java-based diagnostics and monitoring framework. Specifically, the issue emerges from a publicly accessible /heapdump endpoint that does not require authentication — a remnant of legacy configuration practices.
“This flaw allows attackers to extract sensitive memory data from affected systems,” the GreyNoise team explained.
The endpoint leak could expose user data, internal configurations, or even session tokens, making it an appealing target for advanced persistent threat actors.
TeleMessage Patch Issued, but Risks Remain
TeleMessage, an Israel-based secure messaging service used by enterprises and government clients, confirmed that it patched the vulnerability following a breach in May. However, GreyNoise analysts warn that patch timelines vary, and systems may remain exposed depending on how quickly organizations apply updates.
“TeleMessage has stated that the vulnerability has been patched on their end,” said Howdy Fisher of GreyNoise, “but real-world patching delays leave many systems still at risk.”
The app’s clientele includes U.S. government entities, law enforcement, and financial institutions — making any breach potentially devastating.
Recommendations: Reduce Exposure, Block Malicious IPs
GreyNoise urges organizations using Spring Boot Actuator to:
- Disable or restrict access to the /heapdump endpoint
- Limit exposure of Actuator endpoints such as /health
- Block known malicious IP addresses
These basic hardening measures can significantly reduce vulnerability to ongoing exploitation.
Implications for Crypto and Government Data Security
With crypto theft already surpassing $2.1 billion in 2025, the ongoing targeting of platforms like TeleMessage highlights widening attack surfaces in the intersection of financial technology and secure communications.
Government institutions and crypto exchanges must now reassess exposure to third-party app vulnerabilities.
As threat actors continue reconnaissance, the window for silent data harvesting remains open — until patching is universal and defensive perimeters are reinforced.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.