A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months
Reco tracks City-Forum, an actor abusing Salesforce and ServiceNow guest-user access from one IP for 17 months to enumerate portal data.
Reco's City-Forum investigation found one IP address, tied to a dormant 2002 domain, anonymously enumerating Salesforce Experience Cloud and ServiceNow portals across telecoms, banks, enterprise software vendors, and public sector since at least March 2025. No vulnerability was exploited and no credentials were used; the actor abused over-permissioned guest users, including a previously undocumented ServiceNow portal search endpoint, with the busiest single target logging over 560,000 events. Audit logs show what was requested but not which records or fields were returned, so defenders must replay anonymous requests to assess exposure.
- Targets include telecoms, banks, enterprise software vendors, and public-sector portals.
- Custom tooling hit the Salesforce Aura framework and a previously undocumented ServiceNow search endpoint.
- Activity resembles ShinyHunters Experience Cloud campaigns, but attribution remains open.
- Defenders must simulate anonymous guest requests to determine what data was actually exposed.
- Vendors
- SalesforceServiceNow
- Threat actors
- City-ForumShinyHunters
- Organizations
- RecoSalesforceServiceNow
From the original article
6 min read at helpnetsecurity.com
Most security stories start with something broken. This one starts with everything working as designed. Researchers at Reco have been tracking a campaign they call City-Forum, named after a domain registered in 2002, abandoned, and now resolving to a generic rented server from a German hosting provider.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.