> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Long-running Data Theft Campaign Targeting Salesforce, ServiceNow - URL: https://f4n6.co.uk/security-feed/long-running-data-theft-campaign-targeting-salesforce-servicenow/ - Published: 2026-08-13T08:40:35.000Z - Updated: 2026-08-13T08:40:35.000Z - Author: Jeff Davies - Tags: #security-feed, City-Forum ## 1\. Executive summary The "City-Forum" campaign has been active since at least March 2025, conducting a long-running data theft operation targeting Salesforce and ServiceNow portals across multiple sectors worldwide. The actor exploits unauthenticated guest access — functionality operating as designed — to enumerate and exfiltrate exposed records without exploiting a software vulnerability. Attribution to the actor "City-Forum" is unconfirmed: the name derives from a domain registered in 2002 and now resolving to a generic rented server at a German hosting provider, but the actor has no MITRE ATT&CK profile in the verified reference data. EMEA financial services using Salesforce or ServiceNow guest portals should immediately audit guest-user data exposure. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18: classification of ICT-related incidents and cyber threats | Active since March 2025 — a sustained, 17-month campaign targeting platforms holding customer and operational data. | Clients must classify this as an ICT-related cyber threat and assess whether any resultant data exposure constitutes a major incident under their internal taxonomy. | | DORA Art. 28: ICT third-party risk — general principles | The attack targets data held on Salesforce and ServiceNow SaaS platforms — ICT third-party services. | Clients must review whether guest-access configurations on these third-party platforms expose data beyond intended boundaries and incorporate this into third-party risk assessments. | No NIS2 or UK NIS article is specifically engaged beyond generic incident-management obligations that apply to any security event. ## 3\. Technical analysis & attack chain The campaign does not exploit a CVE or software vulnerability. It abuses unauthenticated guest access — a legitimate feature of both Salesforce and ServiceNow — to enumerate and exfiltrate data that is accessible to guest users without authentication. The technical detail available from the source material is limited; the following is what is corroborated across the three sources. ### Attack chain 1. **Infrastructure setup.** The actor operates from a domain registered in 2002, previously abandoned, now resolving to a generic rented server at a German hosting provider. The campaign name "City-Forum" derives from this domain. 2. **Guest-access enumeration.** The actor leverages unauthenticated guest access on Salesforce and ServiceNow portals to enumerate exposed records. No credentials are required; the access path is a designed feature of both platforms. 3. **Data exfiltration.** Records are pulled from the exposed portals to the actor's server. The activity has been ongoing for at least 17 months and has not stopped. **Custom tooling.** SecurityWeek reports the use of a "custom toolset." No further technical detail on the tooling — filenames, hashes, command-line arguments, network protocols, or C2 infrastructure beyond the hosting server — is available in the source material. **Observed impact.** Data theft from Salesforce and ServiceNow portals across organisations in multiple sectors globally. The scope of exposed data (record types, volume, sensitivity) is not specified in the available sources. **Confidence caveat.** The campaign reporting originates from a single research vendor (Reco) and is corroborated by two independent publications (Help Net Security, SecurityWeek) referencing the same research. The technical mechanism — guest-access abuse — is consistently described across all sources. However, specific technical artefacts (tooling, IOCs, exact data types) are single-sourced to Reco and not independently verified. Attribution to "City-Forum" is unconfirmed; the actor has no MITRE ATT&CK profile in the verified reference data. ## 4\. Mitigation & containment ### P1 — within 24 hours - **Audit guest-user access on all Salesforce and ServiceNow instances.** Identify all objects, records, and fields accessible to unauthenticated guest users. Both platforms provide guest-user visibility tools — run them immediately. - **Review guest-user sharing settings.** Salesforce: review Public Access Settings and sharing rules for sites/communities using guest user licenses. ServiceNow: review ACLs and roles applied to the `guest` or `public` user on customer portals. - **Restrict or disable guest access** to any object or record set containing customer PII, financial data, or operational data not explicitly intended for public consumption. ### P2 — within 72 hours - **Implement least-privilege guest configurations.** Ensure guest users can access only the specific records and fields required for the intended public-facing functionality. Remove broad read access at the object level. - **Enable and review platform audit logs.** Salesforce: review Login History and Event Monitoring for guest-user record access patterns. ServiceNow: review sys\_audit and transaction logs for guest-user queries. Look for anomalous enumeration patterns — high-volume record access, sequential ID access, or access from unexpected IP ranges. - **Block known actor infrastructure.** Identify and block the German hosting provider IP range associated with the "City-Forum" domain at the network egress layer, if retrievable from Reco's published research. Note: no specific IP or domain IOC was available in the source material provided to this advisory — obtain the full Reco report for atomic indicators. ### P3 — within 7 days - **Conduct a retrospective access review.** Determine whether guest-user data exposure has been exploited in your environment going back to March 2025\. Cross-reference guest-user access logs against hosting-provider IP ranges. - **Engage with Salesforce and ServiceNow account teams** to confirm whether platform-level guidance or configuration hardening has been issued in response to this campaign. - **Update third-party risk assessments** for both platforms to reflect the guest-access exposure vector. ## 5\. Indicators of compromise No atomic indicators of compromise (IPs, domains, hashes, filenames) are available in the source material provided. The sources reference a domain registered in 2002 and a German hosting provider server but do not publish the domain name, IP address, or any file-based indicators. Obtain the full Reco research report for specific IOCs. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- | | Unauthenticated guest-user record access at high volume or sequential enumeration patterns | Salesforce Event Monitoring (guest user); ServiceNow sys\_audit / transaction logs (guest/public user) | Medium — consistent with described campaign methodology; single-sourced to Reco research | | Inbound connections from German hosting provider IP ranges accessing guest-accessible portal endpoints | Network firewall / WAF logs, CDN access logs | Low — inferred from infrastructure description; no specific IP published in available sources | | Guest-user queries returning record sets beyond expected public-facing scope | Salesforce debug logs / Event Monitoring; ServiceNow instance logs | Medium — consistent with described exploitation of guest-access misconfiguration | ## 6\. Detection Insufficient indicators to author detection rules. No file hashes, command-line strings, mutex names, registry keys, user-agent strings, or other threat artefacts are present in the source material. The campaign's behavioural indicators (guest-user enumeration patterns) are best detected through platform-native audit logging and SIEM correlation rather than YARA or Sigma rules. Clients should build SIEM detection logic around the behavioural indicators in §5 using their Salesforce Event Monitoring and ServiceNow log feeds. ## 7\. Sources - Dark Reading — "Long-running Data Theft Campaign Targeting Salesforce, ServiceNow" — https://www.darkreading.com/cyberattacks-data-breaches/long-running-data-theft-campaign-salesforce-servicenow — 2026-08-12 - Help Net Security — "A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months" — https://www.helpnetsecurity.com/2026/08/12/salesforce-servicenow-guest-user-exposure/ — 2026-08-12 - SecurityWeek — "Stealthy 'City-Forum' Attacks Target Salesforce and ServiceNow With Custom Toolset" — https://www.securityweek.com/stealthy-city-forum-attacks-target-salesforce-and-servicenow-with-custom-toolset/ — 2026-08-12 ## 8\. Adverse Trace position This is a medium-severity threat for EMEA financial services. The attack requires no vulnerability exploitation and relies on misconfiguration of legitimate platform features — meaning exposure is environment-specific and depends entirely on how each client has configured guest access on their Salesforce and ServiceNow instances. The 17-month active period and the targeting of customer-facing platforms holding PII and financial data elevate the risk for institutions that have not audited guest-user sharing settings. Attribution to "City-Forum" is unconfirmed (no MITRE ATT&CK profile); the campaign reporting is single-sourced to Reco, though the technical methodology is plausible and consistently described. We will monitor for the full Reco report containing atomic IOCs and update this advisory if specific indicators or additional technical detail on the custom toolset becomes available. Clients should treat this as a configuration-audit priority, not a patch-priority event. --- [Read the original source →](https://www.darkreading.com/cyberattacks-data-breaches/long-running-data-theft-campaign-salesforce-servicenow?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*