TeleMessage Vulnerability Exploited by 11 IP Addresses Since April

Recent reports have highlighted ongoing exploitation attempts targeting the CVE-2025-48927 vulnerability in TeleMessage, a messaging app designed for secure communications and compliance archiving. This vulnerability has become a focal point for cyber attackers, with at least eleven IP addresses actively attempting to exploit the flaw since April. Thousands more have conducted reconnaissance by scanning for Spring Boot Actuator endpoints, which are used for diagnostic purposes but remain publicly accessible without authentication.

The vulnerability arises from TeleMessage’s legacy use of Spring Boot Actuator’s /heapdump diagnostic endpoint. This exposure allows threat actors to extract sensitive data from affected systems, posing significant risks, especially given TeleMessage’s clientele, which includes government agencies and major enterprises. Following a security breach in May that led to stolen files and a temporary suspension of services, TeleMessage has reportedly patched the vulnerability. However, the timeline for full mitigation varies widely across environments, emphasizing the need for users to implement additional protective measures.

GreyNoise, a threat intelligence firm, has identified over 2,000 IP addresses that have scanned for Spring Boot Actuator endpoints in the last 90 days, with 1,582 specifically targeting the /health endpoint. This endpoint typically reveals the presence of Actuator services, enabling attackers to identify vulnerable systems before launching exploits. To mitigate these risks, GreyNoise recommends that organizations restrict or disable access to the /heapdump endpoint and limit exposure to all Actuator endpoints. Network administrators should also consider blocking IP addresses identified as malicious and continuously monitor for unusual scanning activity to prevent potential breaches.

The ongoing exploitation of vulnerabilities like CVE-2025-48927 occurs against a backdrop of escalating crypto-related thefts in 2025. High-profile incidents, including the February hack of a crypto exchange and physical “wrench attacks” on Bitcoin holders, illustrate the diverse tactics employed by threat actors. Credential theft remains a primary vector, often facilitated through phishing, malware, and elaborate social engineering schemes. These developments underscore the critical need for enhanced cybersecurity protocols across the crypto ecosystem, especially for platforms handling sensitive user data and compliance records.

Given TeleMessage’s user base, which includes entities such as US Customs and Border Protection and a crypto exchange, the vulnerability’s exploitation could have far-reaching consequences. Enterprises relying on TeleMessage for secure communication and regulatory compliance must prioritize vulnerability management and endpoint security to safeguard sensitive information. Security experts advise continuous vulnerability assessments, prompt patch application, and user education to mitigate risks associated with legacy software components. Additionally, organizations should adopt a layered security approach, integrating network monitoring and threat intelligence to detect and respond to emerging threats effectively.

The persistent targeting of TeleMessage’s CVE-2025-48927 vulnerability highlights the evolving threat landscape facing compliance-focused messaging platforms and the broader crypto industry. While patches have been issued, the widespread reconnaissance activity and the high value of compromised data necessitate vigilant security practices. Users and organizations must actively restrict vulnerable endpoints, monitor network traffic for suspicious behavior, and stay informed about emerging threats to protect their digital assets and maintain regulatory compliance.