Reco Links City-Forum Data Theft Campaign to Exposed Salesforce and ServiceNow Portals
Summary
Reco reports that the ongoing City-Forum campaign uses a single IP to retrieve data exposed to guest users through Salesforce and ServiceNow portals. The activity abuses permissive access, not product vulnerabilities.
Key points
- Reco attributes the ongoing campaign to 158.220.87.79, which it says has targeted organizations worldwide; the IP is associated with city-forum[.]com.
- On Salesforce, the activity enumerates and retrieves records exposed to guest users through Aura endpoints and Salesforce UI API GraphQL requests on LWR sites.
- Reco says the attacker also targets ServiceNow Service Portals through the anonymous search API; transaction logs do not capture POST bodies, limiting visibility into search terms.
- The campaign also probes Salesforce self-registration endpoints, which could enable guest users to create external accounts with broader access.
- Reco says the activity exploits overly permissive sharing rules or portal configurations, not vulnerabilities in Salesforce or ServiceNow.
- Reco reports no evidence linking City-Forum to ShinyHunters, despite similarities to that group’s previous use of Salesforce Aura.
- Reco recommends reviewing guest-user permissions, sharing and self-registration settings, and restricting ServiceNow portal search sources to appropriate access.
Article Details
- Attack Vectors
- The attacker queried Salesforce Aura endpoints to enumerate data objects accessible to guest users and retrieve exposed records.
- On Salesforce sites using Lightning Web Runtime, the attacker sent GraphQL requests through the UI API to access data exposed to guest accounts.
- The attacker probed Salesforce self-registration endpoints to identify sites where a guest might create an external account.
- The attacker sent anonymous POST requests to ServiceNow Service Portal search, varying search terms to enumerate information available to guest users.
- Defensive Notes
- Review Salesforce guest-user sharing rules, object and field permissions, file access, member visibility, and self-registration settings.
- For Salesforce LWR sites, disable guest access to public APIs in Experience Builder when it is not required.
- Review which search sources are exposed through ServiceNow Service Portals; require strict authentication and access controls for sources containing sensitive data.
- Reco notes that ServiceNow transaction logs do not record the POST body, limiting defenders’ ability to determine the search terms used.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | city-forum[.]com | Domain associated with the server used in the City-Forum campaign; it has resolved to the campaign IP address since at least March 2025. |
| IPV4 | 158[.]220[.]87[.]79 | IP address Reco says the City-Forum attacks originate from. |
MITRE ATT&CK
T1119 · Automated CollectionThe attacker used repeated automated API requests and varied ServiceNow search terms to enumerate and collect exposed records.T1213 · Data from Information RepositoriesThe attacker retrieved records from Salesforce and ServiceNow portals where guest access exposed information.
Threat Actors
Vendors
Contabo#CityForumSalesforceReco has uncovered the City-Forum campaign, an ongoing data-theft operation that uses custom tools to steal records exposed to anonymous users in Salesforce Experience Cloud and ServiceNow portals.ServiceNowReco has uncovered the City-Forum campaign, an ongoing data-theft operation that uses custom tools to steal records exposed to anonymous users in Salesforce Experience Cloud and ServiceNow portals.
Products
AuraThe activity is tied to the IP address 158.220.87.79 and has been linked to broad targeting of organizations worldwide, including attacks against Salesforce Aura and LWR sites as well as ServiceNow Service Portals.Lightning Web RuntimeHowever, the City-Forum attacker is not only targeting these same Aura endpoints, but also Salesforce sites built using the newer Lightning Web Runtime (LWR) framework.Salesforce Experience CloudReco has uncovered the City-Forum campaign, an ongoing data-theft operation that uses custom tools to steal records exposed to anonymous users in Salesforce Experience Cloud and ServiceNow portals.ServiceNow Service PortalsThe activity is tied to the IP address 158.220.87.79 and has been linked to broad targeting of organizations worldwide, including attacks against Salesforce Aura and LWR sites as well as ServiceNow Service Portals.
Tools
AuraInspector#CityForumCirrusGoReco says it has not seen any public attack tools using this technique, and existing tools such as AuraInspector, S-RET, and CirrusGo do not use the webruntime interface.S-RETReco says it has not seen any public attack tools using this technique, and existing tools such as AuraInspector, S-RET, and CirrusGo do not use the webruntime interface.
Industries
Enterprise softwareThese organizations include telecommunications companies, banks and financial services firms, enterprise software vendors, security and data privacy companies, and public-sector portals.Security and data privacyThese organizations include telecommunications companies, banks and financial services firms, enterprise software vendors, security and data privacy companies, and public-sector portals.TelecommunicationsThese organizations include telecommunications companies, banks and financial services firms, enterprise software vendors, security and data privacy companies, and public-sector portals.