Actor Profile

City-Forum is an ongoing data theft campaign, not a formally attributed threat actor group. The campaign has been active since at least March 2025 and is characterized by consistent infrastructure use—a single IP address (158.220.87.79) hosted by German VPS provider Contabo, associated with the domain city-forum.com. The motivation appears to be mass data exfiltration from organizations that have misconfigured SaaS portals, exposing sensitive information to unauthenticated guest users. The campaign targets multiple sectors globally, including telecommunications, banking and financial services, enterprise software vendors, security and data privacy firms, and public-sector organizations. Activity volumes are increasing, suggesting an active and expanding operation. No direct attribution to known threat actors has been established, though some TTPs overlap with previous ShinyHunters campaigns.

TTPs (Tactics, Techniques, Procedures)

The City-Forum campaign exploits misconfigured Salesforce Experience Cloud and ServiceNow customer portals to steal data exposed to unauthenticated guest accounts. On Salesforce, attackers enumerate accessible objects via the Aura framework using HostConfigController.getConfigData and retrieve records with SelectableListDataProviderController.getItems (T1213: Data from Information Repositories). For newer Lightning Web Runtime (LWR) sites, they leverage Salesforce's UI API via GraphQL requests to /webruntime/api/services/data/{version}/graphql—a technique not seen in public tooling. Attackers also probe /SiteRegister and /CommunitiesSelfReg endpoints to identify self-registration capabilities that could enable authenticated access escalation (T1078: Valid Accounts). On ServiceNow, the campaign abuses the native /api/now/sp/search endpoint to enumerate and exfiltrate data exposed through portal search sources (T1213). All requests originate from a single IP using the default Go-http-client/1.1 user agent (T1071.001: Application Layer Protocol - Web Protocols). The campaign relies on automated enumeration and data retrieval rather than exploiting software vulnerabilities (T1190 not applicable), focusing instead on configuration weaknesses (T1562.001: Impair Defenses - Disable or Modify Tools, indirectly via misconfiguration exploitation).

Targets & Patterns

City-Forum targets organizations across multiple high-value sectors worldwide, including telecommunications companies, banks and financial services firms, enterprise software vendors, security and data privacy companies, and public-sector portals. The common thread is the use of Salesforce Experience Cloud or ServiceNow Service Portals with guest-user access enabled. The campaign does not appear to discriminate by geography, suggesting opportunistic targeting based on portal misconfiguration rather than strategic victim selection. The attacker focuses on environments where overly permissive sharing rules, permissions, or portal configurations expose sensitive data to unauthenticated users. One targeted environment recorded over 560,000 events from the attacker's IP, nearly all related to guest Aura enumeration, indicating persistent and high-volume data collection. The increasing activity volume suggests the campaign is actively scanning for and exploiting newly discovered misconfigured portals.

Historical Context

The City-Forum campaign shares tactical similarities with previous ShinyHunters data theft operations, which also targeted Salesforce Experience Cloud guest-user misconfigurations using modified versions of the AuraInspector tool. However, City-Forum differs in several key aspects: it uses a single, persistent IP address (158.220.87.79) since at least March 2025, whereas ShinyHunters typically employed multiple systems and rotating IP addresses. Additionally, City-Forum has expanded its toolkit to include GraphQL-based enumeration of Salesforce LWR sites via the /webruntime/api interface—a technique not observed in public attack tools or previous campaigns. The campaign also targets ServiceNow Service Portals via the /api/now/sp/search endpoint, which Reco had not previously seen abused. Despite the overlapping Aura framework techniques, researchers have found no evidence directly linking City-Forum to ShinyHunters or other known threat actors. The campaign's infrastructure stability and expanding target scope suggest a distinct operation with sustained operational security.

Defensive Recommendations

  • Block or monitor traffic from IP address 158.220.87.79 (Contabo-hosted) and domain city-forum.com; alert on connections using the Go-http-client/1.1 user agent accessing Salesforce or ServiceNow portals.
  • Audit Salesforce Experience Cloud guest-user permissions: review sharing rules, object/field-level security, and file access to ensure sensitive data is not exposed to unauthenticated users. For LWR sites, disable the Experience Builder option allowing guest users to access public APIs unless explicitly required.
  • Monitor Salesforce Aura framework endpoints (/aura, /s/sfsites/aura) for high-volume requests from unauthenticated users invoking HostConfigController.getConfigData or SelectableListDataProviderController.getItems (T1213). Alert on anomalous guest-user enumeration activity exceeding baseline thresholds.
  • Detect GraphQL-based enumeration on Salesforce LWR sites by monitoring POST requests to /webruntime/api/services/data/*/graphql from guest accounts. Implement rate limiting and logging for these endpoints.
  • Review ServiceNow Service Portal search source configurations to ensure sensitive data is not accessible via /api/now/sp/search to unauthenticated users. Enable strict authentication and access controls, and monitor for automated search enumeration patterns (e.g., rapid successive requests with varying search terms).