TeleMessage TM SGNL Breach: Signal-Clone Archiving App Used by US Officials Hacked
In May 2025, after a photo showed national security adviser Mike Waltz using TeleMessage's modified Signal app, 404 Media reported a hacker had accessed archived messages from its servers; owner Smarsh suspended all TeleMessage services on 5 May.
02Deep-Dive Technical Analysis
TM SGNL modified Signal so messages could be copied to an archive for record-keeping compliance, but archived messages were not end-to-end encrypted between the app and TeleMessage's archive server. The intruder accessed message contents, contacts and back-end credentials; 404 Media reported the cabinet's and Waltz's messages were not among them. The underlying flaw, CVE-2025-48927, was a Spring Boot Actuator heap-dump endpoint exposed without authentication, which can leak in-memory data such as credentials. CISA added it and CVE-2025-48928 to its Known Exploited Vulnerabilities catalog on 1 July 2025.
03Vulnerability & Exploit Flow
An unauthenticated diagnostic endpoint on the archiving server exposed in-memory data such as credentials and message content.
04Recommended Defense & Mitigation Protocol
Disable or authenticate diagnostic endpoints, keep archived messages encrypted end to end, and require security vetting of messaging tools for officials.
05Security Impact & Geopolitical Consequence
Showed that compliance archiving can undo end-to-end encryption guarantees, prompting congressional scrutiny of government use of unofficial messaging clones.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.