CA-26-031: The City-Forum Campaign and the Exploitation of Salesforce and ServiceNow Guest User Configurations

SaaS Security, Data Exfiltration, Guest User Exploitation, Cloud Security, Salesforce, ServiceNow

Source Material: Reco | Technology: Salesforce, ServiceNow  | Targeted Industries: Telecommunications, Banking, Enterprise Software, Data Privacy

Executive Summary

The “City-Forum” campaign represents a mature threat targeting SaaS platforms. Active since at least March 2025, the campaign executes data exfiltration operations targeting globally distributed Salesforce Experience Cloud sites and ServiceNow (SNOW) Service Portals. Available reporting indicates that the threat actor systematically extracts sensitive records, including intellectual property, customer support cases, and financial data without zero-day exploits, credential harvesting, or authentication bypasses. The campaign relies on the weaponization of platform features, exploiting overly permissive read configurations on public-facing “Guest User” profiles.

Researcher observations detail the threat actor’s operations as an anonymous visitor, deploying a custom, multi-platform enumeration toolset to interact directly with public APIs and backend data layers. Sensitive data is exfiltrated from the target platforms due to lack of guest access hardening. This advisory details what is currently known about the threat actor’s static infrastructure, their Tactics, Techniques, and Procedures (TTPs) against Salesforce and ServiceNow architectures, and actionable remediation strategies.

Threat Overview and Strategic Impact

The City-Forum campaign highlights some of the risks associated with the SaaS shared responsibility model. While platform vendors secure the underlying infrastructure, customers are responsible for granular access controls. Salesforce and ServiceNow both utilize mandatory “Guest” accounts to run public-facing sites (support hubs, forums). When these guest profiles are granted broad read permissions across internal objects, anyone on the internet can extract those records.

The observed target organizations in this campaign include a variety of industries including public sector, telecommunications, banking, software vendors, and privacy organizations. The attacker uses a proprietary, compiled Go binary optimized for high-volume concurrent execution (User Agent: Go-http-client/1.1). It maps schemas and extracts data from Salesforce (legacy Aura and modern Lightning Web Runtime) and ServiceNow Service Portals from a single host machine.

TTP Highlights:

• Salesforce Aura: Abuses the /aura endpoint via the getConfigData controller to map internal custom objects (identified by the __c suffix). It then extracts data via the getItems method.
• Salesforce LWR: Iterates API versions (v56.0 through v66.0) against the GraphQL endpoint. It queries the EntityDefinition object for schema mapping, then uses GraphQL cursor-based pagination for automated data scraping.
• ServiceNow: Targets the undocumented /api/now/sp/search endpoint. The endpoint returns a 201 status regardless of success, the attacker must review the byte size of the returned JSON body to infer successful data extraction from Knowledge Bases and Service Catalogs.

Unlike the historical ShinyHunters group, who utilized public extortion and rotating infrastructure, City-Forum operator has maintained a static VPS (158.220.87[.]79) for 17 months. Researchers are not aware of any extortion demands, suggesting their intent may be focused on espionage or private data brokerage.

Security Hardening and Recommendations

Organizations should adopt a “default deny” configuration model for all guest profiles.

Salesforce Environments:

• Disable Public APIs (LWR): In Experience Builder, navigate to Workspaces > Administration > Preferences. Uncheck “Allow guest users to access public APIs”. This disables the GraphQL/UI-API attack surface.
• Restrict Sharing Rules: Under Sharing Settings, set Default External Access for all objects to Private. Ensure “Secure guest user record access” is active. Delete any Guest User Sharing Rules that expose sensitive standard or custom (__c) objects.
• Strip Profile Permissions: In the Guest User Profile Object Settings, remove “Read” access for any object the site does not strictly need to render. Uncheck “Access Activities” to protect internal tasks/events.
• Disable Self-Registration: If not required, disable /SiteRegister and /CommunitiesSelfReg to prevent automated account provisioning.

ServiceNow Environments:

• Audit Public Portals: Review the sp_portal and m2m_sp_portal_search_source tables to identify which search sources are exposed unauthenticated via /api/now/sp/search.
• Enforce User Criteria: Remove unconstrained “Any User” criteria from Knowledge Bases and Service Catalogs. Scope visibility using strictly defined ACLs based on roles or groups.
• Secure Custom Scripts: Ensure custom scripted search sources utilize the GlideRecordSecure API class (which enforces ACLs) rather than standard GlideRecord, and implement explicit login gates (if (!gs.isLoggedIn()) return;).

Detection Strategy

Since this attack leverages legitimate application features, traditional network signatures are unlikely to detect this activity. Detection requires behavioral analytics and application-layer logs for the targeted software.

How Deepwatch Protects Our Customers

The Deepwatch Threat Hunt team is actively querying customer environments for historical activity from the identified artifacts associated with this campaign. Our expert SOC analysts continuously monitor available telemetry for suspicious activity targeting enterprise SaaS infrastructure. Deepwatch actively deploys and tunes detection logic to utilize available threat intelligence which may identify activity indicative of the City-Forum campaign.

Relevant Detections

Please visit the Guardian Platform to access the relevant detections for this activity and ask NEXA Detection Advisor for a breakdown of which detections are enabled in your environment.

Threat Hunting Leads

• Search perimeter and proxy logs for connections to the static City-Forum infrastructure IP: 158.220.87[.]79.
• Hunt for the default Go HTTP client User Agent (Go-http-client/1.1) executing against SaaS portal URIs by guest users.

Salesforce Hunting (Event Monitoring):

Review historical EventLogFile records (specifically AuraRequest and Sites events). Filter the USER_TYPE for Guest.

• Aura: Look for calls to HostConfigController/ACTION$getConfigData followed by a massive burst of SelectableListDataProviderController/ACTION$getItems.
• LWR: In Sites logs, search the REQUEST_URI for patterns containing /webruntime/api/services/data/. Look for sequential version numbers indicating API sweeping.

ServiceNow Hunting (syslog_transaction):

Administrators must ensure syslog_transaction is added to glide.ui.permitted_tables to allow reporting. 

• Review web logs for high-frequency POST requests to /api/now/sp/search containing the sysparm_cancelable=true parameter.
• Filter for Created by = guest and URL starts with /api/now/sp/search. Sort by the Output length column. Investigate any rows where the output length deviates significantly above the baseline empty-result size, indicating successful data leakage.

Technical Artifacts 

Please visit the Guardian Platform to access the associated technical artifacts.

Threat Object Mapping

Intrusion Set:

• Unattributed

Attack Pattern (MITRE ATT&CK/MITRE ATLAS):

Tactic	Technique	Technique ID	Associated Threat Activity
Reconnaissance	Search Open Technical Databases	T1596.005	Identifying exposed customer support portals and APIs.
Initial Access	Exploit Public-Facing Application	T1190	Exploiting misconfigured read access on SaaS APIs.
Discovery	Account Discovery	T1087	Enumerating user schemas and internal account records.
Collection	Data from Cloud Storage Object	T1530	Extracting data from Salesforce/SNOW backend databases.
Exfiltration	Exfiltration Over Web Service	T1567	Extracting data via native GraphQL and REST API queries.

Vulnerabilities:

• N/A – The campaign relies on the exploitation of native platform features and user misconfigurations (Overly permissive Guest User access) rather than software vulnerabilities.

Malware/Tool:

• Proprietary, multi-platform enumeration and exfiltration binary compiled in Go.

Additional Sources

• Help Net Security: A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months
• SecurityWeek: Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset
• DarkReading: Long-running Data Theft Campaign Targeting Salesforce, ServiceNow

↑