This Week in Cybersecurity
A single threat actor has spent over a year systematically scraping records from enterprise customer portals across both Salesforce and ServiceNow, according to new research from SaaS security firm Reco. Dubbed the "City Forum" campaign, the activity originates from a dedicated server hosted on a German VPS provider, targeting organizations spanning financial services, telecommunications, enterprise software, and government portals.
Rather than exploiting traditional zero-day vulnerabilities, the campaign leverages misconfigured guest access. Both Salesforce Experience Cloud and ServiceNow maintain default "guest user" identities that unauthenticated visitors operate under. If a guest profile is granted read permissions beyond what is strictly necessary, any data associated with those objects becomes effectively public.
The attacker utilizes custom, compiled Go-based tooling to execute high-volume data harvesting. The campaign targets:
Salesforce: Legacy Aura framework endpoints and modern Lightning Web Runtime sites via the UI-API (iterating across API versions v56.0 to v66.0).
ServiceNow: Native Service Portal search endpoints (
/api/now/sp/search) to pull exposed internal data.
Key Executive Takeaways:
Audit Guest Profiles: The underlying API endpoints are functioning as designed. Remediation requires stripping unnecessary object- and field-level permissions from guest accounts and disabling public API access where not required.
Review Knowledge Bases: On ServiceNow, audit search sources and read criteria tied to public-facing portals to prevent internal documentation leaks.
Monitor Traffic: Security teams should inspect logs for default Go client user agents (
Go-http-client) and anomalous query spikes against portal search endpoints.
Thanks for reading. As technology continues to evolve, staying informed and proactive is the best way to protect and grow your business.
If there’s a topic you’d like us to cover, just hit reply and let us know.