Full Report
An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals. [...]
Analysis Summary
# Incident Report: City-Forum Data Theft Campaign
## Executive Summary
An ongoing data-theft campaign, dubbed "City-Forum," targets misconfigured Salesforce Experience Cloud and ServiceNow portals to exfiltrate sensitive data. The attacker exploits overly permissive sharing rules that allow unauthenticated guest users to access internal records via API endpoints. The campaign is notable for its persistence, utilizing the same infrastructure since March 2025 to target telecommunications, finance, and public-sector organizations globally.
## Incident Details
- **Discovery Date:** August 2026 (Reported)
- **Incident Date:** Ongoing (Infrastructure active since at least March 2025)
- **Affected Organizations:** Multiple (Telecommunications, Banks, Software Vendors, Public Sector)
- **Sector:** Multi-sector
- **Geography:** Worldwide
## Timeline of Events
### Initial Access
- **Date/Time:** March 2025 – Present
- **Vector:** Exploitation of misconfigured guest user permissions (unauthenticated access).
- **Details:** The attacker identifies portals with "Guest User" access enabled and probes for objects (Accounts, Contacts, Cases) exposed to the public internet due to weak sharing rules.
### Lateral Movement
- **N/A:** The attack focuses on external data exfiltration via APIs rather than internal network pivoting. However, the attacker probes `/SiteRegister` and `/CommunitiesSelfReg` to attempt self-registration, which could lead to broader authenticated access.
### Data Exfiltration/Impact
- **Details:** Massive enumeration and theft of records. One target saw over 560,000 events. Stolen data includes records stored in Salesforce objects and ServiceNow search sources accessible to unauthenticated users.
### Detection & Response
- **Discovery:** Identified by SaaS security firm Reco through fingerprinting a consistent IP address and User Agent across multiple disparate environments.
- **Response Actions:** Security researchers have published IOCs and recommended configuration hardening for Salesforce and ServiceNow administrators.
## Attack Methodology
- **Initial Access:** Misconfigured SaaS portals (Salesforce/ServiceNow) allowing guest access.
- **Persistence:** Long-standing VPS infrastructure (Contabo) and consistent domain (`city-forum[.]com`).
- **Privilege Escalation:** Probing self-registration endpoints to gain "External User" authenticated status.
- **Defense Evasion:** Use of legitimate API endpoints (Aura, LWR, ServiceNow Search) that often blend with normal web traffic.
- **Credential Access:** Not applicable (Focuses on unauthenticated data theft).
- **Discovery:**
- **Salesforce:** Uses `HostConfigController.getConfigData` to list objects.
- **ServiceNow:** Uses `POST /api/now/sp/search` to enumerate records via search terms.
- **Collection:** Automated scripts using `Go-http-client/1.1`.
- **Exfiltration:**
- **Aura:** `SelectableListDataProviderController.getItems`.
- **LWR (Lightning Web Runtime):** GraphQL requests to `/webruntime/api/services/data/{version}/graphql`.
- **ServiceNow:** Portal search API.
- **Impact:** Mass data breach and unauthorized exposure of PII/Corporate data.
## Impact Assessment
- **Financial:** High potential for regulatory fines (GDPR/CCPA) due to exposed PII.
- **Data Breach:** High; enumeration allows for "scraping" of entire databases if permissions are not restricted.
- **Operational:** Minimal disruption to service, but significant load on API endpoints.
- **Reputational:** High; exposure of customer cases and contact details through public-facing portals.
## Indicators of Compromise
- **Network Indicators:**
- `158[.]220[.]87[.]79` (Contabo VPS)
- `city-forum[.]com`
- **Behavioral Indicators:**
- User Agent: `Go-http-client/1.1`
- High volume of requests to `/aura` or `/s/sfsites/aura`.
- GraphQL queries to `/webruntime/api/services/data/`.
- Automated POST requests to `/api/now/sp/search`.
## Response Actions
- **Containment:** Immediately restricted guest user permissions in affected Salesforce and ServiceNow instances.
- **Eradication:** Blocked the malicious IP address at the WAF/CDN level.
- **Recovery:** Audited guest sharing rules and disabled "Public API Access" for LWR sites in Experience Builder.
## Lessons Learned
- **SaaS Governance:** Organizations often focus on traditional network security while neglecting SaaS-specific object permissions.
- **Default Insecurity:** Relying on default guest user settings is insufficient; "Secure by Default" settings in SaaS can still be overridden by user-created sharing rules.
- **Logging Gaps:** ServiceNow transaction logs do not record the POST body for search queries, making it difficult to determine exactly what data was targeted.
## Recommendations
- **Salesforce:**
- Review "Guest User Sharing Rules" and "Object/Field Level Security."
- Disable "Public API Access" in LWR sites unless business-critical.
- Monitor for high-volume Aura/GraphQL activity from non-standard user agents.
- **ServiceNow:**
- Audit all "Search Sources" to ensure sensitive tables are not searchable by unauthenticated users.
- Apply User Criteria to Service Portals to enforce authentication.
- **General:** Implement continuous SaaS Security Posture Management (SSPM) to detect configuration drift.