Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset

1. Executive summary

A sophisticated, ongoing campaign designated "City-Forum" has been actively exploiting unauthenticated guest user access in Salesforce and ServiceNow portals to enumerate and exfiltrate exposed data. Active for at least 17 months from a single IP address (158.220.87.79) resolving to city-forum[.]com, the actor utilizes a custom multi-platform Go binary targeting Salesforce Aura, LWR, and an undocumented ServiceNow Service Portal search endpoint. EMEA financial services firms are explicitly among the primary targets. Attribution is unconfirmed; the actor "City-Forum" has no MITRE ATT&CK profile, and researchers state they cannot rule known threat groups in or out.

2. Regulatory framing

3. Technical analysis & attack chain

This is a threat-campaign item. The attack chain is reconstructed from Reco's research as described in the source material. All technical claims below are single-sourced to Reco's reporting; verify before enforcement.

Attack chain

1. Infrastructure setup: The actor registered city-forum[.]com (a domain originally registered in 2002, abandoned, then repurposed) resolving to a single rented server at IP 158.220.87.79 on a German hosting provider. The same IP has carried the same domain since March 2025 with no rotation — a deliberate choice to reduce footprint to anomaly detection systems.
2. Target identification: The actor scans for organizations with Salesforce Experience Cloud sites and ServiceNow Service Portal instances exposed to the internet. Primary targets include telecoms, banks and financial-services firms, enterprise-software vendors, and public-sector portals.
3. Salesforce guest user exploitation (Aura): Every Salesforce Experience Cloud site has a Guest User profile. The actor sends unauthenticated requests through the guest user context. If the guest can read a record, so can anyone on the internet. Requiring login does not remove the guest user profile, its permissions, its sharing rules, or code running in its context. The actor enumerates accessible records via the Aura interface. This is the first observed in-the-wild exploitation of Salesforce's UI-API guest surface against Aura.
4. Salesforce guest user exploitation (LWR): The same Go binary also targets the newer Salesforce LWR (Lightning Web Runtime) implementation, pulling data via GraphQL queries against the guest user surface.
5. ServiceNow guest user exploitation: The actor targets an effectively undocumented ServiceNow Service Portal search endpoint with almost no online documentation or known open-source tooling. The attacker uses this endpoint to detect substantial content — examining the "Output length" column to identify searches returning more data than the small empty-result baseline, then pulls from the most likely results.
6. Data exfiltration: Exfiltration is high-volume but protocol-legitimate, making detection difficult. The busiest target logged over 560,000 events across the campaign window, essentially all guest Aura enumeration. Traffic blends with legitimate API/protocol behavior.
7. Potential escalation (not observed): In Salesforce, if self-registration is enabled, conversion from guest user to an authenticated user is possible, which could provide access to more sensitive data. No similar mechanism exists for ServiceNow. Researchers state they have only observed guest user activities, never an authenticated user, but cannot rule it out.

Key technical distinctions from prior campaigns

• Unlike the ShinyHunters Salesforce Aura campaign (disclosed March 2026), which used a modified version of the existing AuraInspector tool and targeted only Aura, City-Forum uses a custom Go binary integrating attacks across Salesforce Aura, Salesforce LWR, and ServiceNow in a single toolset.
• The ServiceNow search endpoint targeted has almost no online documentation, indicating custom reconnaissance and tooling development rather than off-the-shelf exploitation.

Attribution caveat: The actor "City-Forum" has no MITRE ATT&CK profile. Attribution is unconfirmed. Reco explicitly states: "We don't know who this is, and we're not ruling anyone in or out." The name derives from the city-forum[.]com domain, not from any established threat group taxonomy.

4. Mitigation & containment

P1 — Within 24 hours

• Block known infrastructure: Block IP 158.220.87.79 and domain city-forum[.]com at perimeter firewall, proxy, and DNS resolver layers. This is the single known source of all campaign activity.
• Audit Salesforce Experience Cloud guest user exposure: For every Salesforce Experience Cloud site, review the Guest User profile's object permissions, field-level security, and sharing rules. Identify any objects where the guest user has Read access to records containing sensitive, financial, or personally identifiable data. Restrict guest user sharing rules to remove access to non-public records.
• Audit ServiceNow Service Portal guest access: Review the Service Portal search endpoint configuration. Identify what content is searchable by unauthenticated/guest users. Restrict the search endpoint to return only public knowledge base content.

P2 — Within 72 hours

• Review Salesforce self-registration configuration: Determine whether self-registration is enabled on any Experience Cloud site. If enabled and not strictly required, disable it. If required, ensure the self-registration process does not grant elevated access beyond the guest user profile.
• Query historical logs for campaign IOCs: Search Salesforce and ServiceNow access logs, API event logs, and network firewall logs for traffic originating from 158.220.87.79 or resolving city-forum[.]com, covering March 2025 to present. The busiest observed target logged 560,000+ events — look for high-volume guest user API activity patterns.
• Assess data exposure scope: For any sites where guest user access to sensitive records is confirmed, conduct a retrospective review of what data was accessible and whether exfiltration likely occurred. Document findings for incident classification.

P3 — Within 7 days

• Implement guest user access governance: Establish a recurring (monthly minimum) audit of guest user profiles across all Salesforce Experience Cloud and ServiceNow instances. Track changes to sharing rules and object permissions that could expand guest user access.
• Deploy behavioral monitoring for guest user API activity: Configure SIEM alerts for anomalous guest user API volume, unusual geographic source IPs, and sustained enumeration patterns against Salesforce Aura/LWR and ServiceNow Service Portal endpoints.
• Validate third-party SaaS security configuration: Incorporate guest user exposure checks into the SaaS security assessment process for new and existing Salesforce and ServiceNow tenants, aligned with DORA Art. 28 third-party risk obligations.

5. Indicators of compromise

ipv4  158.220.87.79
domain  city-forum[.]com

Behavioural indicators

6. Detection

rule City_Forum_Go_Toolset {
  meta:
    author = "Adverse Trace"
    date = "2026-08-12"
    reference = "https://www.securityweek.com/stealthy-city-forum-attacks-target-salesforce-and-servicenow-with-custom-toolset/"
    description = "Detects network artefacts associated with City-Forum campaign infrastructure"
  strings:
    $domain = "city-forum.com" ascii
    $ip = "158.220.87.79" ascii
  condition:
    any of them
}

title: Network Connection to City-Forum Campaign Infrastructure
id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects network connections to known City-Forum campaign IP or domain
author: Adverse Trace
date: 2026/08/12
references:

  - https://www.securityweek.com/stealthy-city-forum-attacks-target-salesforce-and-servicenow-with-custom-toolset/
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationIp|cidr:

      - "158.220.87.79/32"
    DestinationHostname|contains:

      - "city-forum.com"
  condition: selection
falsepositives:

  - Legitimate traffic to the historical city-forum.com domain (registered 2002, abandoned, repurposed)
level: high

7. Sources

• SecurityWeek — "Stealthy 'City-Forum' Attacks Target Salesforce and ServiceNow With Custom Toolset" — https://www.securityweek.com/stealthy-city-forum-attacks-target-salesforce-and-servicenow-with-custom-toolset/ — 2026-08-12
• Help Net Security — "A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months" — https://www.helpnetsecurity.com/2026/08/12/salesforce-servicenow-guest-user-exposure/ — 2026-08-12

8. Adverse Trace position

This is a high-impact campaign for EMEA financial services clients. The attack requires no vulnerability exploitation — it abuses native guest user functionality and misconfigured sharing rules in two of the most widely deployed SaaS platforms in the sector. The 17-month persistence from a single IP with no rotation, combined with protocol-legitimate exfiltration, indicates a capable operator with custom tooling and a deliberate low-profile approach. The single known IP and domain provide an immediate, high-confidence blocking opportunity that clients should act on within hours. However, detection of historical exposure requires log review: any client with a Salesforce Experience Cloud site or ServiceNow Service Portal exposed to the internet must assume potential enumeration and assess what data was accessible to the guest user profile. Attribution is unconfirmed and single-sourced to Reco; we are treating the actor designation "City-Forum" as a campaign label only. We will monitor for additional IOCs, attribution updates, and any Salesforce or ServiceNow platform-level guidance on guest user hardening.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.