In a concerning development for cloud security, a single infrastructure has been systematically extracting information from Salesforce and ServiceNow portals across various sectors for over a year. This revelation comes from Reco, an agent security platform, which disclosed these findings earlier this week.
Named the City Forum campaign, this operation traces its roots to a singular server with the IP address 158.220.87.79, hosted by Contabo in Germany. The operation utilizes the Go programming language’s net/http library, indicating a dedicated application, not a standard browser tool. This IP has been linked to the same domain since March 2025, and its targets include telecommunications, financial services, enterprise software vendors, and public sector portals.
Distinctive Characteristics of the Attack
Unlike previous Salesforce abuse cases, such as those by ShinyHunters, this campaign has a broader target range. Utilizing both Salesforce’s older Aura framework and the newer Lightning Web Runtime sites, the attacker manages to access API versions from v56.0 to v66.0. Similarly, the ServiceNow portal is accessed via the /api/now/sp/search endpoint, which lacks extensive public documentation.
The core issue, as outlined by Reco, is excessive access granted to guest identities on these platforms. Both Salesforce and ServiceNow portals maintain guest user profiles that, if not properly restricted, can expose sensitive data to unauthorized users.
Identifying and Mitigating the Threat
Reco provides detailed steps for detecting and mitigating these threats. For Salesforce, security teams should scrutinize AuraRequest and Sites log events, particularly looking for the Go-http-client user agent and specific request paths. On ServiceNow, the transaction logs should be analyzed for unusual activities from the source IP and anomalies in search request results.
Effective remediation involves tightening guest profile permissions rather than altering endpoint configurations. Salesforce administrators are advised to review guest sharing rules and limit unnecessary access, while ServiceNow users should audit public-facing portal configurations and knowledge base access criteria.
Current Status and Future Outlook
The infrastructure driving this campaign remains operational, and activity levels are reportedly increasing. Reco has not yet attributed this activity to any known group. Detailed technical insights, including request signatures and query samples, are available in Reco’s comprehensive report on the City Forum campaign.
For security leaders considering budget allocation for application exposure protection, Reco offers a framework that covers how to prioritize investments, evaluate suppliers, and justify expenditures to corporate boards.
To stay updated on similar topics, follow our publications on Google News, Twitter, and LinkedIn, where we share exclusive content and insights.
