Listen to this Post
Introduction: When Misconfiguration Becomes the Attack Surface
For more than a year, an unknown threat actor has quietly targeted organizations running Salesforce and ServiceNow, searching for something far less dramatic than a zero-day: data that organizations accidentally left exposed.
Researchers at AI cybersecurity company Reco have named the campaign “City-Forum,” after infrastructure associated with the attacker. The campaign has reportedly been active since at least March 2025 and has reached organizations across telecommunications, financial services, enterprise software, cybersecurity, data privacy, and public-sector environments.
What makes City-Forum particularly concerning is not simply the number of organizations targeted. It is the method.
Rather than depending entirely on conventional vulnerability scanners or well-known attack frameworks, the operators appear to have studied how Salesforce and ServiceNow work internally, identified lesser-known paths to publicly accessible information, and developed custom tooling around those discoveries.
That changes the security conversation.
The attacker does not necessarily need to break through a hardened corporate network if an internet-facing portal is already willing to provide sensitive information to an anonymous or guest user.
And that is the uncomfortable lesson behind City-Forum: sometimes the most dangerous door is the one administrators forgot was unlocked.
What Is the City-Forum Campaign?
A Long-Running Data Theft Operation
Reco researchers say the campaign has been active since at least March 2025, making it a long-running operation rather than a short-lived scanning campaign.
The threat actor has reportedly examined Salesforce and ServiceNow deployments belonging to organizations across North America, Europe, and Asia.
The activity appears focused on discovering systems where guest or unauthenticated access has been configured too broadly.
Instead of attacking every organization indiscriminately, the actor appears to search for environments where configuration creates an opportunity to retrieve information without needing legitimate credentials.
The Real Target: Over-Permissive Guest Access
Security Controls Can Fail at the Configuration Layer
Salesforce and ServiceNow are powerful enterprise platforms precisely because they can be customized extensively.
That flexibility, however, introduces a security challenge.
Organizations can create public portals, customer-service interfaces, knowledge bases, registration pages, searchable content, and other services that need some degree of external accessibility.
The danger emerges when the permissions granted to those public-facing components extend farther than intended.
A guest account might need to see one specific piece of information.
A poorly configured environment may allow it to see hundreds or thousands.
City-Forum appears to be searching for exactly those situations.
Salesforce: Looking Beyond the Obvious Interfaces
The Lightning Web Runtime Changes the Equation
One of the most interesting aspects of the campaign involves Salesforce environments using Lightning Web Runtime, or LWR.
Historically, security researchers and attackers have examined
City-Forum appears to have gone further.
Reco researchers believe the threat actor developed techniques for interacting with underlying data-access functionality associated with LWR and used those techniques to retrieve records from surfaces that organizations had unintentionally made accessible.
This is significant because it demonstrates an important evolution in enterprise application reconnaissance.
The attacker is not merely asking, “What is publicly visible?”
The attacker appears to be asking, “How does this platform retrieve the information underneath what is publicly visible?”
Custom Tooling Makes the Campaign More Interesting
This Was Not Simply a Copy-and-Paste Attack
According to Reco researcher Nitay Bachrach, the actor appears to have built its own tooling after studying how Salesforce and ServiceNow operate.
That distinguishes City-Forum from attackers who simply download public scanners and point them at a target list.
The operators appear to have investigated application behavior, mapped potential data-leak vectors, reproduced scenarios in development environments, and examined application traffic.
That requires preparation.
It also suggests that enterprise SaaS platforms themselves are increasingly becoming targets for specialized reconnaissance.
ServiceNow: An Overlooked Search Path
The Service Portal Search Endpoint
City-Forum did not stop with Salesforce.
Reco researchers observed similar activity against a relatively obscure ServiceNow Service Portal search endpoint.
The endpoint reportedly has limited public documentation and few well-known open-source security tools built specifically around it.
That makes the technique particularly noteworthy.
The attacker appears to have discovered functionality that many security teams may not routinely monitor.
This is precisely where custom research can provide an advantage over conventional security tooling.
Why ServiceNow Exposure Can Be Dangerous
A Knowledge Base Can Contain More Than Knowledge
ServiceNow is highly configurable, meaning the consequences of excessive public access depend heavily on how an organization has designed its platform.
Knowledge bases can contain internal procedures, troubleshooting information, operational documentation, customer-support material, and other organizational data.
In some environments, information placed into a knowledge system may have been written with the assumption that only authenticated users could access it.
If that assumption is wrong, the information can become an intelligence source for an attacker.
What Data Could Be Exposed?
Salesforce Can Contain Extremely Sensitive Information
According to
In particularly sensitive deployments, Salesforce may also contain customer information such as financial records, medical information, government identification data, payment information, support tickets, email content, calendars, and internal communications.
The important qualification is that these categories are potential exposures, not proof that every City-Forum target exposed all of this information.
The actual impact depends on each
ServiceNow Exposure Depends on Configuration
There Is No Single ServiceNow Risk Profile
ServiceNow environments can be customized dramatically.
One organization might expose only a handful of public knowledge articles.
Another could potentially expose much more valuable operational information.
This is why administrators cannot assume that a platform’s default behavior accurately represents their organization’s security posture.
The question is not simply whether ServiceNow is secure.
The question is:
What did your organization configure ServiceNow to expose?
City-Forum and ShinyHunters
Similar Targets, Different Methods
At first glance, City-Forum may resemble previous Salesforce-focused activity associated with the ShinyHunters cybercrime group.
Both campaigns have demonstrated interest in Salesforce environments and data accessible through improperly configured guest access.
However, Reco says the tooling and techniques observed in City-Forum differ from those previously associated with ShinyHunters.
That distinction matters.
It suggests that Salesforce guest-access weaknesses are not a single campaign-specific problem.
They represent a broader class of enterprise configuration weaknesses that multiple threat actors can independently discover and exploit.
Why This Does Not Require a Zero-Day
The Attack Is Sophisticated Without Being a Zero-Day
City-Forum demonstrates an important distinction in modern cybersecurity.
An attack does not need a zero-day vulnerability to be technically sophisticated.
The attacker reportedly had to study platform behavior, identify unusual access paths, reproduce those behaviors, build tooling, and automate discovery.
That is significant research.
But the final entry point may still be a configuration problem.
This combination is particularly dangerous because organizations often devote substantial attention to patching vulnerabilities while overlooking how legitimate application functionality can become an unintended data-exposure mechanism.
AI Could Lower the Barrier
Attack Research Is Becoming Easier
Reco’s researchers also point out that artificial intelligence could make this kind of reconnaissance more accessible.
AI can help attackers understand application behavior, analyze documentation, interpret traffic, generate test scripts, compare responses, and accelerate experimentation.
That does not mean AI automatically creates sophisticated attacks.
A capable operator still needs infrastructure, testing environments, technical knowledge, and a clear understanding of the target.
But AI can reduce the amount of time required to move from curiosity to operational tooling.
The Global Scope of the Campaign
North America, Europe, and Asia Were Targeted
Reco’s review of customer logs indicates activity involving organizations in multiple regions.
North America, Europe, and Asia all appear in the observed targeting.
The Salesforce portion of the campaign appears to have affected more organizations than the ServiceNow activity observed by researchers.
That difference may reflect Salesforce’s larger footprint, the availability of more attractive exposed data, or simply the attacker’s current priorities.
The Most Important Warning for Administrators
An Indicator Does Not Automatically Mean Data Was Stolen
One of the most important nuances in
A suspicious request may indicate reconnaissance.
A successful request may indicate access.
Actual data theft requires another level of evidence.
Security teams therefore need to avoid both extremes: ignoring indicators and automatically declaring a confirmed breach without forensic evidence.
Audit Every Salesforce Site
Do Not Protect Only the Main Production Environment
Organizations often focus security reviews on their primary Salesforce instance.
That is not enough.
Customer portals, legacy sites, testing environments, public-facing applications, community interfaces, and older configurations can all become overlooked entry points.
Every publicly accessible Salesforce site should be reviewed.
Guest permissions should be examined as though an attacker is already looking at them.
Review Salesforce Guest Permissions
Remove Everything That Anonymous Users Do Not Need
The safest principle is straightforward:
If a guest user does not need access to something, the guest user should not have access to it.
Organizations should review guest-user sharing rules and remove unnecessary record visibility.
Unused permissions should be disabled.
Guest file access should be disabled when unnecessary.
Self-registration should also be reviewed and turned off where there is no legitimate business requirement.
Small permission changes can dramatically reduce the amount of information available to automated reconnaissance.
ServiceNow Requires the Same Discipline
Review Every Public Search Source
ServiceNow administrators should identify which search sources are publicly accessible.
Search sources that do not need to be exposed externally should be removed from public access.
Authentication and authorization should be enforced appropriately for each search source, including custom scripted sources.
This is especially important because custom ServiceNow configurations can behave very differently from one organization to another.
Deep Analysis: How Defenders Can Investigate City-Forum Activity
Start With Salesforce Event Monitoring
Look for Unusual Guest Activity
Salesforce administrators should examine Event Monitoring data for unexpected activity involving guest or unauthenticated users.
A simple conceptual search pattern in a log-analysis platform could look like:
WHERE user_type = Guest
AND event_type IN (API, URI, PageView)
AND timestamp > now() - 30d
The exact fields and syntax will depend on the organization’s logging platform.
The objective is to identify unusual guest requests rather than blindly search for one exact string.
Look for Repeated Enumeration
Automation Leaves Behavioral Clues
Automated attackers frequently generate patterns that differ from normal customer behavior.
Defenders can look for:
guest_request_count > normal_baseline AND unique_records_accessed increases rapidly
Large numbers of sequential requests, unusual query patterns, or repeated access to endpoints that normal visitors rarely touch can justify deeper investigation.
Investigate ServiceNow Transaction Logs
Search for Abnormal Portal Requests
ServiceNow administrators should examine transaction logs for suspicious requests involving public-facing portal functionality.
A conceptual detection query might resemble:
source = "servicenow" AND authentication = "anonymous" AND endpoint CONTAINS "search" | stats count by source_ip, endpoint | sort -count
Again, this is a detection concept rather than a universal ServiceNow query.
The purpose is to identify anomalous anonymous access patterns.
Establish a Baseline First
Not Every Large Request Is Malicious
A common mistake in detection engineering is treating volume as proof of compromise.
A public customer portal may naturally generate thousands of requests.
A knowledge base may receive significant legitimate traffic.
Defenders should therefore establish normal behavior before defining suspicious thresholds.
The strongest detections combine multiple signals: anonymous authentication, unusual endpoints, high request frequency, abnormal geographic patterns, and unexpected record access.
Correlate IP Addresses Carefully
Infrastructure Can Change Quickly
Security teams should correlate suspicious IP addresses across Salesforce, ServiceNow, web application firewalls, identity systems, DNS telemetry, proxy logs, and endpoint monitoring where possible.
However, IP addresses should not be treated as permanent attacker identities.
Cloud infrastructure, proxies, VPNs, compromised servers, and rotating infrastructure can make IP-based attribution unreliable.
An IP indicator is useful for hunting, but behavior is often more durable than infrastructure.
Hunt for Data Access, Not Just Login Events
The Absence of Authentication Is the Clue
Traditional monitoring often emphasizes successful logins.
City-Forum highlights why that is insufficient.
If an attacker abuses legitimate guest functionality, there may be no compromised employee account and no suspicious password authentication.
Instead, the attacker may appear as an ordinary anonymous visitor.
That means organizations need visibility into what anonymous users are allowed to retrieve, not simply who logged in.
Example Detection Logic
Build Rules Around Unexpected Guest Access
A SIEM detection could conceptually use:
IF user_role = guest
AND request_volume > baseline
AND sensitive_object_access = true
THEN alert("Suspicious guest data access")
For stronger detection:
IF anonymous_access
AND unusual_endpoint
AND high_request_rate
AND abnormal_data_volume
THEN escalate_to_investigation
These rules should be tuned to the
Preserve Evidence
Logs Can Become the Difference Between Suspicion and Proof
If suspicious activity is detected, security teams should preserve relevant logs before retention periods erase them.
Useful evidence may include request timestamps, source IP addresses, endpoint paths, user context, response sizes, accessed objects, authentication state, and associated firewall or proxy records.
Investigators should also establish whether suspicious requests resulted in successful responses containing meaningful data.
Test From the Outside
Defenders Should See What Attackers See
One of the strongest defensive exercises is external validation.
Organizations should periodically test their public-facing Salesforce and ServiceNow environments from an unauthenticated perspective.
The question should be simple:
If I had no credentials, what could I discover?
That perspective often reveals problems that internal administrative reviews miss.
Treat Guest Access as a Security Boundary
Anonymous Does Not Mean Harmless
Guest access is often treated as a convenience feature.
In reality, it is a security boundary.
Anything exposed to a guest user should be assumed discoverable.
Anything discoverable should be evaluated for sensitivity.
And anything sensitive should require stronger authorization.
This mindset is more effective than relying exclusively on platform defaults.
What Undercode Say:
The Quiet Attack Is Often the More Dangerous One
City-Forum is interesting because it does not depend on a spectacular exploit.
The attacker appears to be exploiting legitimate functionality configured incorrectly.
That makes the campaign harder to eliminate with traditional patching.
There may be no CVE to patch.
There may be no malicious executable to quarantine.
There may be no employee account to reset.
The application itself may simply be doing what it was configured to do.
That is precisely the problem.
SaaS Platforms Have Become Critical Security Boundaries
Salesforce and ServiceNow are no longer simple business applications.
They can contain customer identities, financial information, medical information, support records, internal documents, operational procedures, and business communications.
Compromise of these systems can therefore have consequences similar to compromise of traditional enterprise infrastructure.
Security teams need to treat SaaS permissions with the same seriousness as firewall rules and identity policies.
Configuration Is Becoming an Attack Surface
For years, organizations have focused heavily on vulnerabilities.
That remains necessary.
But City-Forum demonstrates that configuration deserves equal attention.
A perfectly patched platform can still expose sensitive records if its access controls are too permissive.
The absence of a vulnerability does not automatically mean the absence of risk.
Custom Research Changes the Threat Model
The campaign also demonstrates how attackers can create their own capabilities around poorly documented application behavior.
Public exploit kits are not the only threat.
A determined attacker can reverse-engineer workflows, study application traffic, reproduce behavior, and create specialized automation.
That means defenders should not assume that an obscure endpoint is safe merely because security researchers have not publicly documented it.
Documentation Gaps Can Become Security Gaps
When an application feature has little public documentation, defenders may pay less attention to it.
Attackers do not necessarily share that limitation.
A motivated adversary can investigate undocumented functionality independently.
This creates an uncomfortable asymmetry.
The security team may be protecting the documented architecture.
The attacker may be exploring everything else.
Guest Users Deserve Zero-Trust Thinking
The correct question is not whether a guest user is trusted.
The correct question is:
What is the minimum information this user needs to complete the intended task?
Everything outside that requirement should be denied.
That is essentially least privilege applied to anonymous access.
Salesforce Administrators Should Revisit Old Decisions
Permissions often accumulate over time.
A portal is launched.
A business team requests additional access.
An administrator adds a sharing rule.
Months later, nobody remembers why the permission exists.
Years later, an attacker discovers it.
This is how security debt grows.
Regular permission reviews are therefore not optional housekeeping.
They are part of modern attack-surface management.
ServiceNow Deserves Equal Attention
ServiceNow sometimes receives less attention in public discussions than major identity or cloud platforms.
That does not make it less important.
Because the platform is highly customizable, one organization’s exposure can be radically different from another’s.
Security teams should therefore evaluate actual configurations rather than rely on generic assumptions about what ServiceNow exposes.
Monitoring Anonymous Traffic Is Essential
Organizations often monitor privileged users aggressively.
Anonymous activity receives less attention because there is no identity to investigate.
City-Forum reverses that assumption.
Anonymous traffic can be exactly what the attacker wants.
Organizations should therefore establish baselines for guest traffic and investigate significant deviations.
Data Exfiltration Can Look Like Normal Web Traffic
One of the most challenging aspects of this class of attack is that malicious activity can resemble ordinary application requests.
The attacker may not need malware.
They may not need a reverse shell.
They may not need to exploit memory corruption.
They can potentially request data through normal application interfaces.
That makes behavioral monitoring especially important.
Security Teams Need SaaS-Level Threat Hunting
Traditional endpoint detection and response cannot see everything happening inside SaaS platforms.
EDR can protect laptops and servers.
It cannot necessarily tell you whether a public Salesforce site returned an unexpectedly large number of customer records.
SaaS logging therefore needs to become part of the organization’s threat-hunting architecture.
The Attack Chain May Be Simple
The campaign can be conceptually reduced to a straightforward sequence:
Discover → Enumerate → Identify exposure → Query → Collect → Repeat.
There is nothing inherently exotic about that chain.
Its power comes from scale.
Automation can turn one overlooked permission into thousands of requests.
Scale Makes Small Mistakes Dangerous
A human visitor might discover one exposed record.
An automated tool can discover thousands.
This is why a seemingly minor guest-access mistake can become a major security incident.
The risk is not simply what one visitor can see.
It is what an automated system can systematically extract.
AI Could Accelerate This Process
AI may increasingly help attackers understand unfamiliar SaaS architectures.
It can assist with code analysis, documentation analysis, query generation, traffic interpretation, and troubleshooting.
That means defenders should expect reconnaissance to become faster.
Organizations need to shorten their own discovery cycle as well.
Defensive AI Has a Role Too
The same technology can help defenders.
AI-assisted security tools can identify unusual guest behavior, summarize large volumes of SaaS logs, correlate related events, and highlight permission anomalies.
The future contest may not simply be AI versus humans.
It may increasingly become AI-assisted attackers versus AI-assisted defenders.
Public Portals Need Continuous Testing
Security testing should not end when a portal goes live.
Applications change.
Permissions change.
Business requirements change.
New features are introduced.
An access rule that was safe six months ago may become dangerous after a configuration change.
Continuous validation is therefore more reliable than annual testing alone.
The Most Valuable Security Question
A useful question for every organization is:
“What information can an unauthenticated person retrieve from our public applications today?”
Not last year.
Not after the next audit.
Today.
If the answer is unclear, the organization has a visibility problem.
Indicators Are Only the Beginning
Finding a City-Forum indicator should trigger investigation.
But even without an indicator, organizations should audit their environments.
Threat intelligence tells defenders where an attacker has been.
Configuration auditing tells defenders where an attacker could go.
Both are necessary.
The Bigger Lesson
City-Forum is ultimately a warning about complexity.
Modern SaaS platforms provide enormous functionality.
That functionality creates enormous configuration space.
Every new feature introduces another possible interaction between authentication, authorization, data, APIs, portals, and users.
Attackers only need one unintended path.
Defenders have to understand all of them.
✅ Long-Running Campaign
Reco researchers reported that the City-Forum campaign has been active since at least March 2025 and has targeted organizations across multiple sectors and regions. The reported activity therefore represents a sustained campaign rather than an isolated incident.
✅ Custom Attack Tooling
The research indicates that the threat actor developed custom techniques for Salesforce LWR-related functionality and ServiceNow Service Portal search functionality. This is a major distinction from relying exclusively on publicly available scanning tools.
✅ Guest-Access Misconfiguration Is Central
The campaign is associated with overly permissive guest access and public-facing configuration weaknesses rather than a claim that Salesforce or ServiceNow are inherently vulnerable in their default configurations.
❌ Indicators Do Not Automatically Prove Data Theft
The presence of an attacker-associated indicator does not by itself prove that sensitive information was successfully stolen. Investigators must correlate requests, responses, accessed records, and other evidence before confirming exfiltration.
Prediction
(+1) SaaS Security Monitoring Will Become Standard
Organizations will increasingly treat Salesforce, ServiceNow, Microsoft 365, and other SaaS platforms as first-class security telemetry sources.
Security operations centers will monitor SaaS activity alongside endpoint, network, identity, and cloud infrastructure logs.
(+1) Guest Access Audits Will Become More Frequent
Public-facing SaaS permissions will increasingly be reviewed continuously rather than only during annual security audits.
Automated tools will likely test anonymous access and identify excessive permissions before attackers discover them.
(+1) AI Will Accelerate Defensive Auditing
AI-assisted security systems will increasingly analyze SaaS configurations and logs, identify suspicious anonymous activity, and help administrators understand complicated permission relationships.
This could significantly reduce the time required to discover hidden exposure.
(-1) SaaS Misconfigurations Will Remain a Major Data-Leak Source
As enterprise applications become more configurable, organizations will continue to create accidental exposure through permissions, public portals, search sources, integrations, and legacy configurations.
Attackers will increasingly look for these weaknesses because they can provide valuable data without requiring traditional exploitation.
(-1) Attackers Will Build More Platform-Specific Tooling
City-Forum may be an early example of a broader trend in which attackers develop specialized tooling for individual SaaS ecosystems.
Rather than searching for one universal exploit, future campaigns may map the internal behavior of specific enterprise platforms and build dedicated automation around their weakest configuration patterns.
The Final Warning
City-Forum should not be viewed simply as another Salesforce or ServiceNow security story.
It is a warning about the changing nature of enterprise attacks.
The most dangerous attacker does not always need to break encryption, defeat endpoint protection, steal an administrator’s password, or discover a zero-day.
Sometimes the attacker only needs to discover what your application is already willing to reveal.
Audit every public Salesforce site. Review every ServiceNow portal. Examine every guest permission. Monitor every unusual anonymous request.
Because when a business application becomes a window into sensitive data, the attacker does not need to break the window.
They only need to find out that it was never fully closed.
▶️ Related Video (84% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.darkreading.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
