City-Forum Hackers Exploit Salesforce, ServiceNow Critical Vulnerabilities

Key Takeaways

• A new threat actor, dubbed “City-Forum Campaign,” is conducting a sophisticated, long-running data exfiltration operation.
• The campaign targets Salesforce Experience Cloud sites (Aura and Lightning Web Runtime) and ServiceNow Service Portals globally.
• Data from telecommunications, banking, financial services, enterprise software, and public sector organizations has been impacted since March 2025.
• The attacks exploit overly permissive guest user configurations rather than zero-day vulnerabilities.
• Defenders should audit guest access settings and monitor for specific IP addresses and User-Agents.

A previously unknown cybercriminal group has initiated a large-scale, persistent campaign to extract sensitive data from Salesforce Experience Cloud sites and ServiceNow Service Portals worldwide. Operating since at least March 2025, this sophisticated threat actor has been quietly harvesting information from a diverse array of organizations, including major telecommunications providers, banks, financial services firms, enterprise software vendors, and government entities.

Dubbed the “City-Forum Campaign” by researchers, a name derived from a domain associated with the attacker’s infrastructure, this operation distinguishes itself from more common attacks. Unlike groups such as ShinyHunters, which typically exploit Salesforce’s legacy Aura framework through over-permissioned guest user accounts, the City-Forum Campaign employs a more advanced, multi-pronged strategy.

While the campaign still leverages high-volume enumeration of the Aura framework, it also targets Salesforce’s newer Lightning Web Runtime (LWR) sites via the UI-API data layer, for which public exploitation tools or detailed research are scarce. Concurrently, the attackers are probing an undocumented native search endpoint within ServiceNow Service Portals to achieve their objectives.

Sophisticated Attack Vectors Uncovered

Reco researchers highlight that the attackers’ combined approach demonstrates a deliberate effort by a highly skilled operator. This suggests extensive research into both cloud platforms to identify and exploit unconventional data-leak vectors. The ability to bypass access controls through these methods underscores the inherent risks associated with service portal vulnerabilities.

All observed attack activities originate from a single, consistent IP address: 158.220.87[.]79. This IP is hosted on a Contabo Virtual Private Server (VPS) located in Germany, indicating a centralized and persistent operational base.

Key indicators of the attacker’s infrastructure include:

• Custom User-Agent: Every request observed utilizes the Go-http-client/1.1 user agent, signaling the use of an automated, compiled Go application rather than standard web browser activity.
• Persistent Domain: The originating IP address consistently resolves to city-forum[.]com, a domain that has been linked to the attacker’s command and control infrastructure since March 2025.
• Static Origin: The adversary has maintained this singular IP address for over a year, a departure from the rotating proxy networks commonly employed in broader scanning campaigns, suggesting a focused and deliberate targeting strategy.

As detailed in Reco’s security analysis, the campaign has been effectively exfiltrating enterprise assets without relying on traditional exploit payloads. Adversaries frequently initiate their attacks by mapping organizational perimeters through targeted Google dorking techniques, subsequently deploying automated extraction workflows.

For standard Salesforce deployments, the custom Go tool utilizes Aura’s getConfigData and getItems calls to enumerate and systematically page through exposed objects such as Accounts, Contacts, and Cases. In one instance, a single targeted organization recorded over 560,000 enumeration events.

On LWR sites, the tool queries the GraphQL-based UI-API, systematically sweeping through API versions v56.0 through v66.0 to extract records. The framework also diligently probes for open self-registration portals, which can allow guest accounts to gain elevated access beyond their default profiles.

Regarding ServiceNow, the actor floods the undocumented POST /api/now/sp/search endpoint—the backend component powering the portal’s search interface. This probing determines which Knowledge Bases and service catalog items are readable without requiring authentication. A critical challenge for defenders is that both unauthenticated and authenticated requests to this endpoint return an HTTP 201 Created status code. This behavior means HTTP response codes alone cannot reliably detect unauthorized activity, underscoring the importance of identifying internal API flaws for robust cloud infrastructure security.

Reco researchers emphasize that the campaign does not exploit zero-day platform vulnerabilities. Instead, every retrieved record was accessible due to overly permissive guest user configurations within the targeted environments.

What You Should Do

• Salesforce Environments: Immediately review guest sharing rules, remove unnecessary object and field-level permissions, disable self-registration features where they are not explicitly required, and turn off guest access to public APIs within Experience Builder.
• ServiceNow Environments: Conduct a thorough audit of all search sources connected to public portals and meticulously review Knowledge Base “Can Read” criteria to restrict overly permissive “Any User” grants.
• Threat Hunting: Proactively query your network logs for any traffic originating from 158.220.87[.]79 or requests containing the Go-http-client/1.1 user agent interacting with your portal APIs.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.