ServiceNow, Salesforce and Contabo: "City-Forum" data-theft attacks target Salesforce, ServiceNow portals

Ongoing "City-Forum" Data Theft Campaign Targets Misconfigured Salesforce and ServiceNow Portals

A persistent data theft campaign, tracked as City-Forum by SaaS security firm Reco, is exploiting misconfigured Salesforce Experience Cloud and ServiceNow customer portals to steal exposed data from organizations worldwide. The attacks, active since at least March 2025, originate from a single server (IP address 158.220.87.79, hosted by German VPS provider Contabo) and have targeted telecommunications firms, banks, enterprise software vendors, security companies, and public-sector entities.

Unlike traditional exploits, the campaign does not leverage vulnerabilities in Salesforce or ServiceNow. Instead, it abuses overly permissive guest-user configurations, allowing unauthenticated access to sensitive data. The attacker consistently uses the Go-http-client/1.1 user agent and the city-forum.com domain, which has resolved to the same infrastructure for over a year.

Attack Methods

Salesforce Targets:

• The attacker primarily abuses the Aura framework, sending requests to /aura or /s/sfsites/aura endpoints to enumerate publicly accessible objects (e.g., Accounts, Contacts, Cases).
• Using HostConfigController.getConfigData and SelectableListDataProviderController.getItems, the attacker retrieves records from exposed objects. One victim recorded over 560,000 enumeration events from the attacker’s IP.
• The campaign also targets newer Lightning Web Runtime (LWR) sites, exploiting Salesforce’s UI API via GraphQL requests to /webruntime/api/services/data/{version}/graphql a technique not observed in public attack tools like AuraInspector or S-RET.
• Additional reconnaissance includes probing /SiteRegister and /CommunitiesSelfReg endpoints to check for self-registration, which could enable broader access.

ServiceNow Targets:

• The attacker abuses the POST /api/now/sp/search endpoint, designed for portal search functionality, to extract data from misconfigured search sources. While defenders can detect automated searches, ServiceNow’s logs do not record the exact search terms used.
• Activity has escalated from tens to hundreds of daily requests in some environments.

Key Observations

• The campaign’s infrastructure has remained static since March 2025, unlike previous groups like ShinyHunters, which used multiple IPs.
• While some tactics resemble past ShinyHunters attacks (e.g., Aura endpoint abuse), Reco found no direct link between the two.
• All observed activity involves guest users, though authenticated access cannot be ruled out.

The attacks underscore the risks of misconfigured guest-user permissions in SaaS platforms, where even minor oversights can expose sensitive data to automated theft.

Source: https://www.bleepingcomputer.com/news/security/city-forum-data-theft-attacks-target-salesforce-servicenow-portals/

ServiceNow TPRM report: https://www.rankiteo.com/company/servicenow

Salesforce TPRM report: https://www.rankiteo.com/company/salesforce-experience-cloud

Contabo TPRM report: https://www.rankiteo.com/company/contabo-gmbh

"id": "salsercon1786602506",
"linkid": "salesforce-experience-cloud, servicenow, contabo-gmbh",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': ['Telecommunications',
                                     'Finance',
                                     'Software',
                                     'Cybersecurity',
                                     'Government'],
                        'location': 'Worldwide',
                        'type': ['Telecommunications firms',
                                 'Banks',
                                 'Enterprise software vendors',
                                 'Security companies',
                                 'Public-sector entities']}],
 'attack_vector': 'Misconfigured guest-user permissions in SaaS platforms',
 'data_breach': {'data_exfiltration': 'Yes',
                 'number_of_records_exposed': 'Over 560,000 enumeration events '
                                              'recorded for one victim',
                 'personally_identifiable_information': 'Possible',
                 'sensitivity_of_data': 'High (potentially personally '
                                        'identifiable information)',
                 'type_of_data_compromised': ['Accounts',
                                              'Contacts',
                                              'Cases',
                                              'Other sensitive records']},
 'date_detected': '2025-03-01',
 'description': 'A persistent data theft campaign, tracked as *City-Forum* by '
                'SaaS security firm Reco, is exploiting misconfigured '
                'Salesforce Experience Cloud and ServiceNow customer portals '
                'to steal exposed data from organizations worldwide. The '
                'attacks, active since at least March 2025, originate from a '
                'single server (IP address 158.220.87.79, hosted by German VPS '
                'provider Contabo) and have targeted telecommunications firms, '
                'banks, enterprise software vendors, security companies, and '
                'public-sector entities. The attacker abuses overly permissive '
                'guest-user configurations to gain unauthenticated access to '
                'sensitive data.',
 'impact': {'data_compromised': 'Sensitive data exposed (e.g., Accounts, '
                                'Contacts, Cases)',
            'identity_theft_risk': 'High (if personally identifiable '
                                   'information was exposed)',
            'operational_impact': 'Data enumeration and theft from exposed '
                                  'objects',
            'systems_affected': ['Salesforce Experience Cloud',
                                 'ServiceNow customer portals']},
 'initial_access_broker': {'entry_point': 'Misconfigured Salesforce and '
                                          'ServiceNow portals',
                           'reconnaissance_period': 'Since at least March '
                                                    '2025'},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'Misconfigured guest-user permissions in SaaS platforms '
                    'can expose sensitive data to automated theft. '
                    'Organizations must audit and restrict guest-user access '
                    'to prevent unauthorized data enumeration.',
 'motivation': 'Data exfiltration',
 'post_incident_analysis': {'corrective_actions': ['Restrict guest-user '
                                                   'permissions',
                                                   'Monitor and log access to '
                                                   'sensitive endpoints',
                                                   'Disable unused '
                                                   'self-registration '
                                                   'features'],
                            'root_causes': 'Overly permissive guest-user '
                                           'configurations in Salesforce and '
                                           'ServiceNow portals'},
 'recommendations': ['Audit Salesforce and ServiceNow guest-user '
                     'configurations to ensure least-privilege access.',
                     'Monitor for unusual activity on `/aura`, '
                     '`/s/sfsites/aura`, and `/api/now/sp/search` endpoints.',
                     'Disable self-registration endpoints if not in use.',
                     'Implement enhanced logging for search terms in '
                     'ServiceNow portals.',
                     'Deploy behavioral analytics to detect automated '
                     'enumeration attempts.'],
 'references': [{'source': 'Reco (SaaS security firm)'}],
 'response': {'third_party_assistance': 'Reco (SaaS security firm)'},
 'threat_actor': 'City-Forum (tracked by Reco)',
 'title': "Ongoing 'City-Forum' Data Theft Campaign Targets Misconfigured "
          'Salesforce and ServiceNow Portals',
 'type': 'Data Theft',
 'vulnerability_exploited': 'Overly permissive guest-user configurations in '
                            'Salesforce Experience Cloud and ServiceNow '
                            'portals'}