One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

1. Executive summary

A single attacker operating from IP 158.220.87.79 (Contabo VPS, Germany) has been systematically scraping unauthenticated guest-accessible data from Salesforce Experience Cloud and ServiceNow Service Portal deployments since at least March 2025. The campaign, labelled "City Forum" by Reco after a legacy domain resolving to the attacker's IP, uses a compiled Go-based tool to enumerate and exfiltrate records via Salesforce Aura, Salesforce Lightning Web Runtime UI-API (versions v56.0–v66.0), and the ServiceNow endpoint POST /api/now/sp/search. Attribution to any named threat actor is unconfirmed; no MITRE ATT&CK profile exists for "City Forum." EMEA financial services firms using Salesforce or ServiceNow customer-facing portals with permissive guest profiles are directly exposed to silent data exfiltration of any record the guest identity can read.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: Reco has not attributed this activity to a specific named group. The label "City Forum" is derived from a domain registered in 2002, now abandoned, that resolves to the attacker's IP. Actor "City Forum" has no MITRE ATT&CK profile; attribution is unconfirmed. All technical detail below is single-sourced to Reco's research as reported by The Hacker News, Help Net Security, Dark Reading, and SecurityWeek — verify before enforcement.

Attack chain (confirmed steps)

1. Infrastructure setup: The attacker operates from a single server at 158.220.87.79, a commodity VPS rented from German provider Contabo. Passive DNS shows the associated domain pointing at this IP since at least March 2025. The server has not changed during the campaign.
2. Tooling fingerprint: Every request carries the default user-agent of Go's net/http library (Go-http-client), indicating a compiled, purpose-built Go program rather than browser-driven activity or off-the-shelf scanning tooling.
3. Salesforce Aura enumeration: The tool sends high-volume guest requests against Salesforce Experience Cloud sites using the older Aura framework to enumerate objects and page through records. One target logged over 560,000 events from the single IP. This is the bulk of observed traffic.
4. Salesforce Lightning Web Runtime (LWR) via UI-API: The tool also targets Salesforce's newer LWR sites through the UI-API data layer, walking through API versions v56.0 through v66.0 in sequence. No public write-ups or known scanning tools exist for this surface, indicating custom development.
5. ServiceNow Service Portal search: The same server sends requests to POST /api/now/sp/search, a native ServiceNow endpoint with almost no public documentation. The tool uses this to enumerate and extract exposed Knowledge Base content via anonymous search.
6. Data access and exfiltration: The common thread across all three techniques is the same root cause: the persistent guest user identity on both platforms has been granted more access than the public-facing site requires. On Salesforce, the guest user cannot be deleted — only restricted. If the guest profile can read a record, the record is effectively public regardless of whether the site requires login in a browser. On ServiceNow, Knowledge Base read criteria determine what an anonymous search returns.
7. Self-registration probing: On Salesforce, spikes in self-registration attempts at /SiteRegister and /CommunitiesSelfReg were observed alongside the enumeration activity.

Observed impact: Targets span telecoms, banks and financial services firms, enterprise software vendors (including security and data privacy companies), and public sector portals. Reco has not named individual organisations. The campaign remains active and volume is climbing as of the report date.

Key distinction from prior campaigns: Unlike the widely reported Salesforce guest-access abuse attributed to ShinyHunters, this actor reaches three distinct surfaces (Aura, LWR UI-API, and ServiceNow search), whereas prior actors predominantly leveraged Aura alone.

4. Mitigation & containment

P1 — Within 24 hours

• Block attacker IP: Add 158.220.87.79 to WAF, reverse proxy, and Salesforce/ServiceNow IP-restriction rules where applicable. Note: this is a single known IP; the attacker could rotate infrastructure.
• Hunt for compromise: On Salesforce, pull AuraRequest and Sites log events from Event Monitoring or Shield. Filter for user-agent containing Go-http-client, source IP 158.220.87.79, and request paths containing /webruntime/api/services/data. Also check for spikes at /SiteRegister and /CommunitiesSelfReg.
• Hunt on ServiceNow: Query syslog_transaction filtered by source IP 158.220.87.79 and URLs starting with /api/now/sp/search. Flag guest-created rows and transactions with unusual response output length as indicators of a live sweep.

P2 — Within 72 hours

• Salesforce guest profile remediation:
• Review all guest sharing rules across every Experience Cloud site.
• Strip unnecessary object-level and field-level access from the guest profile.
• Disable self-registration where not required (/SiteRegister, /CommunitiesSelfReg).
• Turn off the Experience Builder setting that allows guest users to reach public APIs.
• ServiceNow guest access remediation:
• Map which search sources are exposed to public-facing Service Portal instances.
• Audit Knowledge Base read criteria to determine what an anonymous search actually returns.
• Restrict KB article visibility to require authentication where content is sensitive.

P3 — Within 7 days

• Establish continuous monitoring: Deploy automated alerts for the Go-http-client user-agent against both platforms' guest-accessible endpoints. Baseline normal guest-user query volume and alert on deviations.
• Guest-profile access review cadence: Institute a recurring (monthly minimum) review of guest-user permissions on all customer-facing Salesforce and ServiceNow instances, treating any newly exposed object or KB article as a change requiring security review.
• Validate against Reco's full technical breakdown: Obtain the full Reco writeup (including request signatures and sample queries) and validate detection coverage against the specific patterns documented.

5. Indicators of compromise

ipv4  158.220.87[.]79
useragent  Go-http-client
httppath  /webruntime/api/services/data
httppath  /api/now/sp/search
httppath  /SiteRegister
httppath  /CommunitiesSelfReg

Behavioural indicators

6. Detection

rule City_Forum_Salesforce_LWR_Enumeration {
    meta:
        author = "Adverse Trace"
        date = "2026-08-18"
        reference = "https://thehackernews.com/2026/08/one-attacker-has-scraped-both.html"
        description = "Detects Go-http-client user-agent and Salesforce LWR UI-API path patterns associated with City Forum campaign"
    strings:
        $ua = "Go-http-client" ascii
        $path_lwr = "/webruntime/api/services/data" ascii
        $path_register1 = "/SiteRegister" ascii
        $path_register2 = "/CommunitiesSelfReg" ascii
        $api_ver = "v56.0" ascii
    condition:
        $ua and 2 of ($path_lwr, $path_register1, $path_register2, $api_ver)
}

title: City Forum Campaign — Salesforce Guest Enumeration from Known Attacker IP
id: 7a3c1f2e-2026-0818-5820-000000000001
status: experimental
description: >
    Detects requests to Salesforce Experience Cloud guest-accessible endpoints
    from the City Forum campaign infrastructure (IP 158.220.87.79, Go-http-client
    user-agent). Covers Aura, LWR UI-API, and self-registration paths.
author: Adverse Trace
date: 2026/08/18
references:

    - https://thehackernews.com/2026/08/one-attacker-has-scraped-both.html
logsource:
    product: salesforce
    service: event_monitoring
detection:
    selection_ip:
        SourceIp: 158.220.87.79
    selection_ua:
        UserAgent|contains: "Go-http-client"
    selection_paths:
        RequestPath|contains:

            - "/webruntime/api/services/data"
            - "/SiteRegister"
            - "/CommunitiesSelfReg"
    condition: selection_ip and selection_ua and selection_paths
falsepositives:

    - Legitimate Go-based automation using the default net/http user-agent (unlikely against these specific paths)
level: high

title: City Forum Campaign — ServiceNow Guest Search Enumeration from Known Attacker IP
id: 7a3c1f2e-2026-0818-5820-000000000002
status: experimental
description: >
    Detects POST requests to ServiceNow Service Portal search endpoint
    (/api/now/sp/search) from the City Forum campaign infrastructure.
author: Adverse Trace
date: 2026/08/18
references:

    - https://thehackernews.com/2026/08/one-attacker-has-scraped-both.html
logsource:
    product: servicenow
    service: syslog_transaction
detection:
    selection_ip:
        SourceIP: 158.220.87.79
    selection_endpoint:
        URL|startswith: "/api/now/sp/search"
    selection_ua:
        UserAgent|contains: "Go-http-client"
    condition: selection_ip and selection_endpoint and selection_ua
falsepositives:

    - Legitimate automated search from a Go-based tool using default user-agent (unlikely from this IP)
level: high

7. Sources

• The Hacker News — "One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025" — https://thehackernews.com/2026/08/one-attacker-has-scraped-both.html — 2026-08-18
• Help Net Security — "A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months" — https://www.helpnetsecurity.com/2026/08/12/salesforce-servicenow-guest-user-exposure/ — 2026-08-12
• Dark Reading — "Long-running Data Theft Campaign Targeting Salesforce, ServiceNow" — https://www.darkreading.com/cyberattacks-data-breaches/long-running-data-theft-campaign-salesforce-servicenow — 2026-08
• SecurityWeek — "Stealthy 'City-Forum' Attacks Target Salesforce and ServiceNow With Custom Toolset" — https://www.securityweek.com/stealthy-city-forum-attacks-target-salesforce-and-servicenow-with-custom-toolset/ — 2026-08

8. Adverse Trace position

This is an active, ongoing data-exfiltration campaign targeting a configuration weakness — guest-user over-permission — that is endemic across Salesforce and ServiceNow customer-facing deployments. The attacker's use of a single static IP and a default Go user-agent makes historical detection straightforward; the harder question is remediation, because the guest user cannot be deleted on Salesforce and the affected endpoints are functioning as designed. EMEA financial services clients should treat this as a high-priority exposure: any record readable by a guest profile is already exfiltrable, and this actor is actively sweeping for exactly that condition. Attribution to "City Forum" is unconfirmed (no MITRE ATT&CK profile); all technical detail is single-sourced to Reco — verify the IP and user-agent against your own logs before enforcing blocks. We will update this advisory if Reco publishes the full technical breakdown with additional IOCs or if the attacker rotates infrastructure.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.