Ongoing "City-Forum" Data Theft Campaign Targets Misconfigured Salesforce and ServiceNow Portals A persistent data theft campaign, tracked as City-Forum by SaaS security firm Reco, is exploiting misconfigured Salesforce Experience Cloud and ServiceNow customer portals to steal exposed data from organizations worldwide. The attacks, active since at least March 2025, originate from a single server (IP address 158.220.87.79, hosted by German VPS provider Contabo) and have targeted telecommunications firms, banks, enterprise software vendors, security companies, and public-sector entities. Unlike traditional exploits, the campaign does not leverage vulnerabilities in Salesforce or ServiceNow. Instead, it abuses overly permissive guest-user configurations, allowing unauthenticated access to sensitive data. The attacker consistently uses the Go-http-client/1.1 user agent and the city-forum.com domain, which has resolved to the same infrastructure for over a year. ### Attack Methods Salesforce Targets: - The attacker primarily abuses the Aura framework, sending requests to `/aura` or `/s/sfsites/aura` endpoints to enumerate publicly accessible objects (e.g., Accounts, Contacts, Cases). - Using `HostConfigController.getConfigData` and `SelectableListDataProviderController.getItems`, the attacker retrieves records from exposed objects. One victim recorded over 560,000 enumeration events from the attacker’s IP. - The campaign also targets newer Lightning Web Runtime (LWR) sites, exploiting Salesforce’s UI API via GraphQL requests to `/webruntime/api/services/data/{version}/graphql` a technique not observed in public attack tools like AuraInspector or S-RET. - Additional reconnaissance includes probing `/SiteRegister` and `/CommunitiesSelfReg` endpoints to check for self-registration, which could enable broader access. ServiceNow Targets: - The attacker abuses the POST `/api/now/sp/search` endpoint, designed for portal search functionality, to extract data from misconfigured search sources. While defenders can detect automated searches, ServiceNow’s logs do not record the exact search terms used. - Activity has escalated from tens to hundreds of daily requests in some environments. ### Key Observations - The campaign’s infrastructure has remained static since March 2025, unlike previous groups like ShinyHunters, which used multiple IPs. - While some tactics resemble past ShinyHunters attacks (e.g., Aura endpoint abuse), Reco found no direct link between the two. - All observed activity involves guest users, though authenticated access cannot be ruled out. The attacks underscore the risks of misconfigured guest-user permissions in SaaS platforms, where even minor oversights can expose sensitive data to automated theft.