A newly identified cyber threat actor, referred to as the ‘City-Forum’ group, has been conducting a large-scale campaign targeting Salesforce Experience Cloud sites and ServiceNow Service Portals worldwide. This operation, active since at least March 2025, has been quietly extracting data from various sectors, including telecommunications, banking, financial services, enterprise software vendors, and public-sector portals.
Unlike previous cybercrime groups that exploited Salesforce’s legacy Aura framework through over-permissioned guest user accounts, the City-Forum group has developed a more sophisticated approach. They have engineered methods to target Salesforce’s newer Lightning Web Runtime (LWR) sites via the ‘UI-API,’ a data layer lacking public exploitation tools or documented research. Simultaneously, they exploit an undocumented native search endpoint within ServiceNow Service Portals.
Security researchers have observed that this combination reflects a deliberate effort by a sophisticated operator who has thoroughly researched both cloud platforms to identify unexpected data-leak vectors. By bypassing access controls in this manner, the attackers highlight similar risks associated with service portal vulnerabilities. All observed attack activity originates from a single IP address: 158.220.87[.]79, hosted on a Contabo Virtual Private Server (VPS) in Germany.
Key indicators of the attack infrastructure include:
- Custom User-Agent: Each request carries the ‘Go-http-client/1.1’ user agent, indicating an automated, compiled Go application rather than a web browser.
- Persistent Domain: The IP resolves to ‘city-forum[.]com,’ a domain linked to the attacker’s infrastructure since March 2025.
- Static Origin: The adversary has maintained this single IP address for over a year, deviating from the rotating proxy networks typically used in broad scanning campaigns.
The operation has been quietly harvesting enterprise assets without relying on traditional exploit payloads. Adversaries often map out organizational perimeters using targeted techniques before executing automated extraction workflows.
On standard Salesforce deployments, the custom Go tool utilizes Aura’s ‘getConfigData’ and ‘getItems’ calls to enumerate and page through exposed objects such as Accounts, Contacts, and Cases. A single targeted organization logged over 560,000 enumeration events.
On LWR sites, the tool queries the GraphQL-based ‘UI-API,’ sweeping through API versions ‘v56.0’ through ‘v66.0’ to extract records. The framework also systematically probes for open self-registration portals, where guest accounts can gain elevated access beyond default profiles.
On ServiceNow, the actor floods the undocumented ‘POST /api/now/sp/search’ endpoint—the backend powering the portal’s search interface—testing which Knowledge Bases and service catalog items are readable without authentication. Because both unauthenticated and authenticated requests return an ‘HTTP 201 Created’ status code, defenders cannot rely solely on HTTP response codes to detect unauthorized activity.
It’s important to note that the campaign does not exploit zero-day platform vulnerabilities. Every retrieved record was accessible due to overly permissive guest user configurations. Organizations are advised to review guest sharing rules, strip unnecessary object and field-level permissions, disable self-registration where unneeded, and turn off guest access to public APIs within Experience Builder.
This incident underscores the critical importance of regularly reviewing and tightening access controls, especially for guest users, to prevent unauthorized data access. Organizations should proactively audit their configurations and implement robust security measures to safeguard sensitive information.
