A newly identified threat actor is running a large-scale, long-running cyber campaign targeting Salesforce Experience Cloud sites and ServiceNow Service Portals globally.
Dubbed the “City-Forum Campaign” after a domain tied to the attacker’s infrastructure, the operation has been quietly siphoning data from telecommunications providers, banks, financial services firms, enterprise software vendors, and public-sector portals since at least March 2025.
Unlike known cybercrime groups such as ShinyHunters, which typically abuse Salesforce’s legacy Aura framework via over-permissioned guest user accounts, this threat actor has engineered a more advanced approach.
While the campaign continues to leverage high-volume Aura enumeration, it also targets Salesforce’s newer Lightning Web Runtime (LWR) sites through UI-API a data layer lacking public exploitation tooling or documented research. Simultaneously, the attackers target an undocumented native search endpoint within ServiceNow Service Portals.
City-Forum Hackers Target Salesforce and ServiceNow
Reco researchers note that this combination reflects a deliberate effort by a sophisticated operator who researched both cloud platforms to map out unexpected data-leak vectors.
Bypassing access controls in this manner highlights similar risks associated with service portal vulnerabilities. All observed attack activity originates from a single IP address: 158.220.87[.]79, hosted on a Contabo Virtual Private Server (VPS) in Germany.
Key infrastructure indicators include:
- Custom User-Agent: Every request carries the
Go-http-client/1.1user agent, indicating an automated, compiled Go application rather than a web browser. - Persistent Domain: The IP resolves to
city-forum[.]com, a domain linked to the attacker’s infrastructure since March 2025. - Static Origin: The adversary has maintained this single IP address for over a year, departing from the rotating proxy networks typically used in broad scanning campaigns.
As detailed in Reco’s security research, the operation has been quietly harvesting enterprise assets without relying on traditional exploit payloads.
Adversaries frequently map out organizational perimeters using targeted Google dorking techniques before executing automated extraction workflows.
On standard Salesforce deployments, the custom Go tool uses Aura’s getConfigData and getItems calls to enumerate and page through exposed objects such as Accounts, Contacts, and Cases. A single targeted organization logged over 560,000 enumeration events.
On LWR sites, the tool queries the GraphQL-based UI-API, sweeping through API versions v56.0 through v66.0 to extract records. The framework also systematically probes for open self-registration portals, where guest accounts can gain elevated access beyond default profiles.
On ServiceNow, the actor floods the undocumented POST /api/now/sp/search endpoint—the backend powering the portal’s search interface—testing which Knowledge Bases and service catalog items are readable without authentication.
Because both unauthenticated and authenticated requests return an HTTP 201 Created status code, defenders cannot rely solely on HTTP response codes to detect unauthorized activity. Uncovering these hidden interfaces demonstrates why identifying internal api flaws is vital for securing cloud infrastructure.
| Platform / Subsystem | Targeted Endpoint / Feature | Mechanism & Method | Defensive Challenge |
| Salesforce Aura | getConfigData / getItems | Automated object and record enumeration | High-volume guest API queries |
| Salesforce LWR | GraphQL UI-API (v56.0 – v66.0) | Unauthenticated record scraping | Lacks public tooling/documentation |
| ServiceNow | POST /api/now/sp/search | Probing Knowledge Bases & Catalogs | Returns HTTP 201 for all requests |
Reco researchers highlight that the campaign does not exploit zero-day platform vulnerabilities. Every retrieved record was accessible due to overly permissive guest user configurations.
- Salesforce Environments: Review guest sharing rules, strip unnecessary object and field-level permissions, disable self-registration where unneeded, and turn off guest access to public APIs within Experience Builder.
- ServiceNow Environments: Audit search sources attached to public portals and review Knowledge Base “Can Read” criteria to restrict permissive “Any User” grants.
- Threat Hunting: Query network logs for traffic from
158.220.87[.]79or requests carrying theGo-http-client/1.1user agent interacting with portal APIs.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model -> Register Now
