TeleMessage Vulnerability Exploited by Multiple IPs Amid Rising Crypto Theft Concerns in 2025

Key Points

1. TeleMessage’s CVE-2025-48927 flaw, involving the Spring Boot Actuator’s /heapdump endpoint, is actively exploited by at least eleven IP addresses since April.

2. GreyNoise reports over 2,000 IP addresses scanned for Spring Boot Actuator endpoints in the last 90 days, with 1,582 revealing vulnerable systems.

3. TeleMessage has patched the vulnerability, but patch deployment timelines vary, leaving systems at risk.

4. The exploitation occurs amid escalating crypto-related thefts in 2025, including high-profile incidents like the Bybit hack and physical attacks on Bitcoin holders.

5. TeleMessage’s clientele includes government agencies and crypto exchanges like Coinbase, making the vulnerability’s exploitation potentially far-reaching.