Full Report
A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a
Analysis Summary
# Incident Report: City Forum Campaign (SaaS Data Scraping)
## Executive Summary
An unidentified threat actor has been systematically scraping sensitive records from Salesforce and ServiceNow customer portals for over a year using a single server. By exploiting over-privileged "Guest User" profiles and undocumented API endpoints, the attacker has targeted multiple industries, including finance, telecommunications, and government. The campaign remains active with increasing volume, leveraging purpose-built tools to automate data exfiltration at scale.
## Incident Details
- **Discovery Date:** August 2026 (Published by Reco)
- **Incident Date:** Active since at least March 2025
- **Affected Organization:** Multiple (Unnamed)
- **Sector:** Telecoms, Banking, Financial Services, Enterprise Software (Security/Data Privacy), and Public Sector
- **Geography:** Global; Attacker infrastructure hosted in Germany
## Timeline of Events
### Initial Access
- **Date/Time:** March 2025 (Earliest identified infrastructure activity)
- **Vector:** Exploitation of Misconfigured SaaS Guest Permissions
- **Details:** The attacker leverages the default "Guest" identity in Salesforce and ServiceNow. By accessing public-facing portals, the attacker exploits configurations where these guest identities are granted excessive read permissions to internal objects and records.
### Lateral Movement
- **Technique:** API Enumeration
- **Details:** While not traditional network lateral movement, the attacker moves "horizontally" across SaaS data layers by sequentially walking through API versions (v56.0 through v66.0) and enumerating objects via the Salesforce Aura framework and Lightning Web Runtime (LWR).
### Data Exfiltration/Impact
- **Details:** Massive scraping of records from customer portals. One targeted organization logged over 560,000 events from the attacker's IP. Stolen data includes records stored in Salesforce objects and ServiceNow Knowledge Bases.
### Detection & Response
- **Discovery:** Identified by security platform Reco through traffic analysis and fingerprinting of a specific Go-based user agent.
- **Response Actions:** Publication of technical signatures and remediation guidance for affected SaaS administrators to tighten guest access controls.
## Attack Methodology
- **Initial Access:** Abuse of unauthenticated guest access on SaaS portals.
- **Persistence:** Not required; the attacker uses persistent infrastructure (158.220.87[.]79) to query public endpoints.
- **Privilege Escalation:** Exploiting over-privileged "Guest User" profiles that have been granted internal object-level permissions.
- **Defense Evasion:** Use of undocumented or rarely used APIs (Salesforce UI-API and ServiceNow `/api/now/sp/search`) that lack standard monitoring coverage.
- **Credential Access:** N/A (Unauthenticated exploit).
- **Discovery:** Automated scanning/paging through Aura framework objects and ServiceNow search endpoints.
- **Lateral Movement:** Sequential API version probing.
- **Collection:** Bulk scraping via purpose-built Go-based tooling.
- **Exfiltration:** Standard HTTP POST/GET requests to a central VPS.
- **Impact:** Mass data breach/unauthorized information disclosure.
## Impact Assessment
- **Financial:** Not disclosed; potential for regulatory fines (GDPR/CCPA) due to data exposure.
- **Data Breach:** High; widespread scraping of enterprise records and sensitive documentation.
- **Operational:** Minimal disruption to service, but high load on API resources.
- **Reputational:** High for targeted firms, particularly those in the security and data privacy sectors.
## Indicators of Compromise
- **Network Indicators:**
- `158.220.87[.]79` (Contabo VPS)
- `cityforum[.]cc` (Associated domain)
- **Behavioral Indicators:**
- User-Agent: `Go-http-client/1.1`
- Request Paths: `/webruntime/api/services/data`, `/SiteRegister`, `/CommunitiesSelfReg`
- ServiceNow Endpoint: `/api/now/sp/search`
- High-volume requests from a single IP targeting `AuraRequest` logs.
## Response Actions
- **Containment:** Blocking the attacker IP at the WAF or SaaS gateway level.
- **Eradication:** Revoking "View All" or excessive read permissions from Guest User profiles in Salesforce and ServiceNow.
- **Recovery:** Auditing transaction logs to determine exactly which records were accessed during the scraping window.
## Lessons Learned
- **SaaS "Shadow" Permissions:** Default guest identities are often overlooked during security audits but provide a direct path to data if sharing rules are too broad.
- **API Visibility:** Attackers are moving away from well-documented APIs to "quiet" endpoints (like UI-API) that security teams may not be monitoring.
- **Tooling Sophistication:** The use of compiled Go binaries suggests a professionalized approach to SaaS scraping beyond simple browser-based scripts.
## Recommendations
- **Salesforce:**
- Disable "Public API Access" in the Experience Builder.
- Review and restrict "Guest Sharing Rules."
- Monitor `AuraRequest` and `Sites` log events for Go-based user agents.
- **ServiceNow:**
- Audit "Knowledge Base" read criteria for anonymous users.
- Monitor `syslog_transaction` for unusual output lengths from the `/api/now/sp/search` endpoint.
- **General:** Implement strict IP rate limiting and geo-blocking for known commodity VPS ranges if they have no legitimate reason to access portal APIs.