City-Forum Campaign Targets Salesforce and ServiceNow Portals Globally

The City-Forum Campaign has been actively siphoning data from Salesforce and ServiceNow portals for 17 months. Researchers at Reco identified the threat actor, who is exploiting guest user access to pull records from various sectors, including telecommunications and banking. The campaign is ongoing, with no signs of cessation. Affected organizations include financial services firms and public-sector portals. The attack leverages legitimate access methods, raising concerns about security configurations. The exact number of compromised records remains unclear, but the scale is significant. This operation highlights vulnerabilities in widely used enterprise platforms. Current status indicates continued data extraction without detection.

Key Points: • The City-Forum Campaign has been active for 17 months, targeting Salesforce and ServiceNow. • Data is being siphoned from various sectors, including banks and telecommunications. • The attack exploits guest user access, indicating potential security configuration issues.