- A single server (158.220.87.87) has been systematically extracting data from Salesforce and ServiceNow customer portals for over a year, using a purpose-built Go program.
- Named the “City Forum” campaign by security firm Reco, the activity targets telecoms, banks, enterprise software vendors, and public sector portals.
- The attack exploits default guest user permissions on both platforms, which cannot be deleted but only restricted, making exposed records effectively public.
- Detection methods include monitoring for the Go-http-client user agent and specific API paths, while remediation focuses on tightening guest profile access rather than modifying endpoints.
- The infrastructure remains active and traffic volume is increasing, though no specific threat group has been attributed.
Security researchers at Reco have uncovered a persistent data exfiltration campaign targeting Salesforce and ServiceNow customer portals, originating from a single German-hosted server (158.220.87.87) that has been active since at least March 2025. The campaign, dubbed “City Forum” after a domain linked to the attacker’s IP, uses a compiled Go program with a unique user-agent fingerprint to systematically enumerate records across telecoms, financial services, enterprise software vendors, and public sector environments.
Unlike previous Salesforce guest access abuse attributed to groups like ShinyHunters, this tool also targets Salesforce’s newer Lightning Web Runtime via the UI-API and a largely undocumented ServiceNow Service Portal search endpoint. Reco observed over 560,000 events from the same IP at one target alone, with the tool cycling through API versions v56.0 through v66.0. The common vulnerability across both platforms is the persistent guest user identity, which cannot be deleted and can expose any record the guest profile can read, regardless of login requirements.
Consequently, Reco recommends security teams monitor for the Go-http-client user agent and specific API paths like /webruntime/api/services/data on Salesforce, and filter ServiceNow transaction logs for URLs starting with /api/now/sp/search. Remediation involves tightening guest sharing rules, disabling unnecessary self-registration, and auditing Knowledge Base read criteria. The full technical breakdown is available in Reco’s writeup of the City Forum campaign.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
