Hacker breaches developer of Signal clone used by the US government.

Summary

By the CyberWire staff

At a glance.

Hacker breaches developer of Signal clone used by the US government.
CISA flags maximum-severity Commvault flaw as actively exploited.
Iranian threat actor targets critical infrastructure in the Middle East.

Hacker breaches developer of Signal clone used by the US government.

404 Media reports that a hacker breached and stole customer data from TeleMessage, the developer of a Signal clone used by the US government to archive messages. TeleMessage recently made the news after former US national security adviser Mike Waltz was photographed using the app to communicate with top White House officials. 404 Media says the hacker doesn't appear to have stolen messages sent by these cabinet members, but obtained data related to Customs and Border Protection, cryptocurrency exchange Coinbase, and other financial institutions.

TeleMessage is an Israeli company that sells modified versions of end-to-end encrypted messaging apps such as Signal and WhatsApp, allowing users to archive messages for legal and regulatory reasons. The company achieves this by storing copies of the messages on a remote server.

The hacker told 404 Media that they targeted TeleMessage because they were "just curious how secure it was." The company hasn't responded to a request for comment.

Stop Identity-Based Cybercrime with SpyCloud’s Holistic Identity Threat Protection

Stolen identity data is the hot commodity for cybercriminals. With the full scope of your users’ digital footprints at risk for exposure, traditional account-centric security is no longer enough to protect your business from cyberattacks. SpyCloud helps security teams correlate and automatically remediate individuals' hidden identity exposures from breaches, malware, and phishing across their many online personas. Eliminate identity-based cyber threats and proactively defend against account takeover, fraud, and ransomware with SpyCloud.

CISA flags maximum-severity Commvault flaw as actively exploited.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity Commvault vulnerability (CVE-2025-34028) to its Known Exploited Vulnerabilities (KEV) catalog, SecurityWeek reports. The data protection software provider patched the vulnerability last month and released details last week. Commvault stated, "A path traversal vulnerability in Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files, which, when expanded by the target server, result in Remote Code Execution. This issue affects Command Center Innovation Release: 11.38."

Iranian threat actor targets critical infrastructure in the Middle East.

Researchers at Fortinet describe a long-term cyberespionage campaign targeting critical infrastructure entities across the Middle East, attributed to an Iranian government threat actor. The campaign involved "extensive espionage operations and suspected network prepositioning—a tactic often used to maintain persistent access for future strategic advantage." The threat actor gained initial access via stolen VPN credentials and maintained persistence with various webshells.

The researchers note, "After containment efforts, the adversary attempted to regain access by exploiting ZKTeco ZKBioTime software vulnerabilities, which had not been previously reported in the wild. They also launched targeted phishing attacks, using compromised third-party emails to steal administrator credentials."

Notes.

Today's issue includes events affecting Iran, Israel, and the United States.

Attacks, Threats, and Vulnerabilities

StealC malware enhanced with stealth upgrades and data theft tools (BleepingComputer) The creators of StealC, a widely-used information stealer and malware downloader, have released its second major version, bringing multiple stealth and data theft enhancements.

Ransomware attacks on food and agriculture industry have doubled in 2025 (The Record) The uptick began in the fourth quarter of 2024 and continued into 2025, with the increases largely attributed to Clop’s exploitation of a popular file sharing service.

Marketplace

Ministry of Foreign and European Affairs Showcases Decent Cybersecurity at Innovation Day on Cybersecurity (BusinessWire) The Ministry of Foreign and European Affairs of the Slovak Republic hosted its 34th "Innovation Day" focused on cybersecurity, presenting Decent Cybersecurity and its partner FREQUENTIS Solutions & Services to ambassadors accredited in Slovakia.

Legislation, Policy, and Regulation

White House Warns China of Cyber Retaliation Over Infrastructure Hacks (Infosecurity Magazine) NSC’s Alexei Bulazel said that failing to robustly respond to constant Chinese intrusions into critical infrastructure is in itself “escalatory”

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

CYSAT (Paris, France, May 14 - 15, 2025) In today’s society, we heavily rely on space-based assets, and considering the continuously evolving cyber threats in the current geopolitical environment, securing space data is a major challenge. Since 2021, CYSEC has been organizing CYSAT to bring together all the players in the space cybersecurity domain.

CyberWiseCon Europe 2025 (Vilnius and virtual, Lithuania, May 21 - 23, 2025) CyberWiseCon is a premier IT security conference that brings together cybersecurity experts, industry leaders, and IT professionals from around the Europe.

NICE Conference (Denver, Colorado, USA, Jun 1 - 4, 2025) The NICE Conference is the annual convening of community members and thought leaders from education, government, industry, and non-profits to explore ways of developing a skilled cybersecurity workforce ready to meet the challenges of the future. This event provides an opportunity to share best practices from around the world and across sectors in order to build the workforce we need to confront cybersecurity risks today and in years to come.

2025 Space Regulatory Bootcamp (Albuquerque and Virtual, New Mexico, USA, Jun 10 - 11, 2025) ACSP's Bootcamps educate new and established space professionals on must-know fundamentals and arm them for success. The 2025 Space Regulatory Bootcamp, hosted in Albuquerque, New Mexico, is a two day comprehensive industry deep dive with advanced training and meaningful networking. Learn directly from leading subject matter experts on topics including space law, export controls, space telecommunications, government contracting, and more.

AWS re:Inforce 2025 (Philadelphia, Pennsylvania, USA, Jun 16 - 18, 2025) AWS re:Inforce is our annual, immersive, cloud-security learning event delivering hands-on training and collaboration with AWS experts. It’s your opportunity to learn about the latest AWS security innovations, get direct access to the AWS teams and partners who build the security tools you rely on, and connect with cloud security peers from around the world. You’ll leave with actionable next steps to raise your security posture.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 05.05.25

At a glance.

Hacker breaches developer of Signal clone used by the US government.

CISA flags maximum-severity Commvault flaw as actively exploited.

Iranian threat actor targets critical infrastructure in the Middle East.

Notes.

Attacks, Threats, and Vulnerabilities

Marketplace

Legislation, Policy, and Regulation

Events