City-Forum Campaign Targeting Salesforce and ServiceNow Guest Access

The 'City-Forum' campaign is a sophisticated, stealthy operation targeting enterprise environments by abusing exposed Guest User access within Salesforce and ServiceNow. First reported in August 2026, the campaign employs a custom Go-based multi-platform toolset to enumerate data through Salesforce Aura, Salesforce LWR implementations (via GraphQL), and undocumented ServiceNow Service Portal search endpoints.

Unlike previous campaigns such as the one attributed to ShinyHunters, City-Forum is notable for its persistence and reliance on a single, long-standing IP address (158.220.87.79) that has remained active since March 2025. The attack focuses on protocol-legitimate traffic to minimize detection by traditional security tools. By exploiting the inherent permissions assigned to Guest Users, the actor systematically scrapes sensitive information that site owners have unintentionally exposed to anonymous users. The campaign primarily targets telecommunications, financial services, enterprise software vendors, and public-sector portals, with some instances logging over 560,000 enumeration events.

Attack Chain

1. Attacker conducts reconnaissance to identify Salesforce Aura/LWR instances and ServiceNow portals with publicly accessible guest endpoints.
2. Attacker interacts with Salesforce Aura surfaces, utilizing the UI-API to enumerate records accessible to unauthenticated guest profiles.
3. Attacker interacts with Salesforce LWR sites, leveraging GraphQL queries to extract structured data in an unauthenticated context.
4. Attacker targets undocumented ServiceNow search endpoints on the Service Portal, systematically iterating through queries.
5. Attacker monitors response sizes from the ServiceNow search endpoint to identify and filter queries that returned meaningful content versus baseline empty results.
6. Attacker exfiltrates identified data through high-volume, protocol-legitimate requests directed to the static C2 infrastructure.
7. Attacker maintains persistent connectivity through a single IP address to evade detection systems relying on infrastructure rotation or domain flux.

Impact

The campaign results in unauthorized exposure and exfiltration of sensitive information, including customer records, financial data, and proprietary enterprise details. The impact is primarily driven by the misconfiguration of guest user sharing rules and permissions, allowing anonymous internet access to sensitive records. While no direct breach of the Salesforce or ServiceNow platforms themselves has been observed, thousands of individual customer instances are potentially exposed, with some targets experiencing over half a million unauthorized data retrieval events.

Recommendation

Prioritized, concrete actions for detection and remediation:

• Audit and restrict Guest User permissions in Salesforce Experience Cloud, ensuring no sensitive data is exposed to unauthenticated anonymous users.
• Disable 'self-registration' features in Salesforce instances to prevent Guest Users from upgrading their privileges to authenticated user sessions.
• Review ServiceNow Service Portal search configurations and apply appropriate ACLs to ensure undocumented search endpoints are not accessible to public guest users.
• Block the IP address 158.220.87.79 and the domain city-forum.com at the network perimeter, as these have been associated with long-term scanning and data retrieval.
• Implement monitoring for unusually high volumes of search queries or UI-API/GraphQL requests originating from unauthenticated sessions in your Salesforce and ServiceNow environments.