Enterprise cloud architects, SaaS security engineers, and Identity and Access Management (IAM) professionals are facing urgent configuration auditing mandates following the public disclosure of a sophisticated, long-running data harvesting operation. Disclosed on August 18–19, 2026, by SaaS security platform Reco, threat researchers have detailed the ‘City Forum’ campaign—a sustained reconnaissance and data-exfiltration operation that has extracted hundreds of thousands of sensitive records from misconfigured Salesforce Experience Cloud and ServiceNow Service Portals across multiple global industries.

Operating continuously from a single static command server since at least March 2025, the campaign demonstrates how adversaries are moving away from noisy brute-force attacks to silently exploit overly permissive unauthenticated Guest User access controls embedded within trusted enterprise portal architectures.

1. Infrastructure and Profiling of the City Forum Threat Actor

Unlike transient cybercrime operations that constantly rotate IP addresses and disposable cloud proxies to evade blocklists, the City Forum actor has maintained an exceptionally steady, low-noise operational footprint. Forensics trace the entire campaign back to a single dedicated Virtual Private Server (VPS) hosted through German cloud provider Contabo under the IP address 158.220.87.79, resolving to the domain city-forum.com.

Network traffic analysis reveals that the attacker utilizes custom compiled tooling authored in Go, fingerprinted consistently across thousands of requests by the default User-Agent header Go-http-client/1.1. By maintaining a single static endpoint and pacing automated API requests just beneath volumetric rate-limiting thresholds, the actor has systematically evaded anomaly-based Web Application Firewall (WAF) heuristics for over 17 months.

2. Dual-Platform Exploitation Mechanics: Abusing Salesforce and ServiceNow Guest Profiles

The City Forum campaign does not rely on zero-day software vulnerabilities or stolen administrative passwords; rather, it weaponizes default and misconfigured guest access permissions that permit anonymous, unauthenticated visitors to query internal database tables and search indices at machine speed.

A. Salesforce Experience Cloud: Aura and Lightning Web Runtime (LWR) Enumeration

Salesforce Experience Cloud (formerly Community Cloud) enables enterprises to build customer support hubs, partner portals, and public forums. To allow public visitors to view general knowledge base articles, Salesforce creates an unauthenticated “Guest User” profile.

However, when enterprise administrators fail to strictly enforce Organization-Wide Default (OWD) sharing rules, custom object permissions, and field-level security, the Guest User profile inadvertently inherits read access to internal database schemas. The City Forum actor sends structured JSON payloads directly to backend endpoints, specifically targeting:

• The Legacy Aura Endpoint (/aura): Sending batch RPC requests to enumerate standard objects (such as User, Contact, Account, and Lead) as well as custom business objects.
• Lightning Web Runtime (LWR) APIs: Leveraging modern client-side data controllers to systematically scrape employee directories, customer support histories, internal email addresses, and partner pricing records. In single targeted Salesforce environments, researchers logged over 560,000 data extraction requests generated by the attacker’s automation.

B. ServiceNow Service Portal: Exploiting Undocumented Search Endpoints

In parallel, the same threat infrastructure targets public-facing ServiceNow Service Portals (/sp), which organizations deploy for IT helpdesk requests, employee onboarding, and service catalogs.

The attacker targets native, poorly documented REST search endpoints (such as /api/now/sp/search and /api/now/table/). By cycling through systematic dictionary queries and wildcard parameters, the custom Go tool forces the portal to dump sensitive internal knowledge base articles, server inventory records, configuration item (CI) metadata, and unredacted incident tickets containing internal credentials and network architecture diagrams.

3. Real-World Scope and Targeted Industry Sectors

Threat intelligence telemetry confirmed that the City Forum actor has actively probed and scraped customer portals across a diverse array of global organizations, including:

• Telecommunications Providers: Harvesting customer subscription metadata and network support tickets.
• Financial Services and Banking Institutions: Extracting loan processing documentation and internal contact registries.
• Enterprise Software and Cybersecurity Vendors: Scraping proprietary bug tracker tickets and customer onboarding configurations.
• Public-Sector Government Portals: Exfiltrating citizen inquiry records and municipal service requests.

4. Comprehensive Defense and Hardening Blueprint for SaaS Environments

To eliminate unauthorized guest data exposure across Salesforce and ServiceNow deployments, enterprise security teams must implement a rigorous hardening framework:

Salesforce Experience Cloud Hardening Steps:

• Audit and Lock Down Guest User Profiles: Review all active Experience Cloud sites and ensure the Guest User profile does not have the “API Enabled” permission toggled on.
• Enforce Secure Guest Record Access: Ensure the “Secure guest user record access” setting is enabled in Salesforce Sharing Settings, which forces default sharing access to Private for all standard and custom objects.
• Inspect Sharing Rules: Verify that Guest User Sharing Rules are strictly restricted only to necessary public content, ensuring sensitive objects (e.g., User, Case, Order) are entirely excluded from guest query scopes.

ServiceNow Service Portal Hardening Steps:

• Restrict Public Search Sources: Audit all Search Sources configured within Service Portals and ensure that any knowledge bases, service catalogs, or table sources containing internal data require authenticated user roles.
• Enforce Table-Level Access Control Lists (ACLs): Review REST Table API configurations to ensure unauthenticated users cannot execute direct queries against core tables (such as sys_user, incident, or cmdb_ci).

SOC and SIEM Detection Engineering:

• Block and Alert on Campaign Indicators: Immediately configure perimeter firewalls, WAFs, and CASB solutions to block inbound traffic from IP 158.220.87.79 and alert on requests originating from the Go-http-client/1.1 user agent hitting portal endpoints.
• Implement Behavioral Anomaly Detection: Configure alerts for sustained, high-volume query bursts originating from unauthenticated sessions across community APIs.

5. Strategic Imperative: SaaS Security Posture Management (SSPM)

The City Forum campaign underscores a fundamental reality of modern cloud security: SaaS misconfigurations represent an exposure surface just as dangerous as unpatched server vulnerabilities. As organizations expand customer and partner collaboration portals, deploying automated SaaS Security Posture Management (SSPM) tools to continuously audit guest permissions, sharing rules, and API visibility is essential to preventing silent, large-scale enterprise data theft.

Source: The Hacker News / Reco SaaS Threat Intelligence