Actor Profile

City Forum is a campaign name assigned by Reco to a coordinated data harvesting operation targeting enterprise SaaS platforms. The activity is attributed to a single attacker infrastructure operating from IP address 158.220.87.79, hosted on a Contabo VPS in Germany. The campaign has been active since at least March 2025, with infrastructure remaining static throughout the operation. The attacker's motivation appears to be large-scale data exfiltration from misconfigured guest access portals across Salesforce Experience Cloud and ServiceNow Service Portal deployments. The operation is characterized by purpose-built tooling (compiled Go binary) and systematic enumeration of API endpoints. No specific threat actor group has been publicly attributed to this campaign.

TTPs (Tactics, Techniques, Procedures)

The campaign leverages misconfigured guest user permissions on enterprise SaaS platforms to harvest data at scale. On Salesforce, the attacker exploits both the legacy Aura framework and the newer Lightning Web Runtime via UI-API (versions v56.0-v66.0), with one target logging over 560,000 events. The tool also targets ServiceNow's native Service Portal search endpoint (POST /api/now/sp/search). All requests carry the default Go net/http library user agent, indicating purpose-built compiled tooling. The attacker enumerates objects, pages through records, and attempts self-registration at /SiteRegister and /CommunitiesSelfReg endpoints. The core technique exploits overprivileged guest profiles that grant unauthenticated users read access to sensitive records—a configuration issue rather than a platform vulnerability. Relevant MITRE ATT&CK techniques include T1213 (Data from Information Repositories), T1530 (Data from Cloud Storage Object), and T1087 (Account Discovery).

Targets & Patterns

The campaign targets organizations across multiple industries including telecommunications, banking and financial services, enterprise software vendors (including security and data privacy firms), and public sector entities. The common denominator is the use of Salesforce Experience Cloud sites or ServiceNow Service Portals with misconfigured guest access permissions. The attacker systematically identifies portals where the persistent guest user identity has been granted excessive read permissions, effectively making private records accessible to unauthenticated requests. The broad industry targeting suggests opportunistic data harvesting rather than sector-specific espionage, with the attacker likely scanning for any exposed portal with overprivileged guest access regardless of vertical. Individual victim organizations have not been publicly disclosed by Reco.

Historical Context

The City Forum campaign represents an evolution from prior Salesforce guest access abuse, most notably activity attributed to the ShinyHunters cybercrime group. While previous attackers primarily focused on Salesforce's older Aura framework with high-volume guest enumeration, City Forum expands the attack surface to include Salesforce's Lightning Web Runtime via UI-API (a data layer with no prior public scanning tools or documentation) and ServiceNow's Service Portal search endpoint. The campaign's infrastructure has remained static since at least March 2025, with passive DNS records showing the same domain pointed at IP 158.220.87.79 throughout the operation. According to Reco, the infrastructure remains active as of August 2026 with increasing request volumes, suggesting an ongoing and escalating operation.

Defensive Recommendations

  • Monitor Salesforce Event Monitoring/Shield logs for AuraRequest and Sites events containing 'Go-http-client' user agent, IP 158.220.87.79, and request paths with '/webruntime/api/services/data'; flag spikes in self-registration attempts at /SiteRegister and /CommunitiesSelfReg endpoints
  • Query ServiceNow syslog_transaction table filtering by source IP and URLs starting with '/api/now/sp/search'; investigate guest-created rows and unusual output lengths as indicators of active data sweeps
  • Audit Salesforce guest profiles to remove unnecessary object and field-level read permissions, review guest sharing rules, disable self-registration where not required, and turn off Experience Builder settings that expose public APIs to guest users
  • Review ServiceNow Service Portal search source configurations and audit Knowledge Base read criteria to restrict what anonymous searches can return; ensure guest profiles follow least-privilege principles
  • Implement rate limiting and anomaly detection for unauthenticated API requests to SaaS portals, particularly for non-browser user agents and sequential API version enumeration patterns (T1213, T1530)