"City-Forum" Campaign Mass-Enumerates Salesforce Experience Cloud and ServiceNow Portals via Guest Access — Threadlinqs Intelligence
As of 2026-08-12, "City-Forum" Campaign Mass-Enumerates Salesforce Experience Cloud and ServiceNow Portals via Guest Access is a high-severity data breach threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 7 indicators of compromise.
Threat ID: TL-2026-1999 · Severity: HIGH · Status: ACTIVE · Category: DATA_BREACH
A ~17-month, unattributed data-harvesting campaign dubbed 'City-Forum' abuses overly permissive Guest User access on Salesforce Experience Cloud (Aura and Lightning Web Runtime) and ServiceNow Service
City-Forum is a large-scale, cross-platform data-harvesting campaign first identified by security research firm Reco and reported publicly on 2026-08-12 by cybersecuritynews.com and SecurityWeek. The campaign has been continuously active since at least March 2025 (roughly 17 months at time of disclosure), targeting telecommunications providers, banks and financial-services firms, enterprise software vendors (including security and data-privacy companies), and public-sector portals. It is notable as the first observed in-the-wild exploitation of Salesforce's UI-API guest surface, and for operating a single unified toolset against two separate SaaS platforms simultaneously rather than a platform-specific script.
Mechanically, the campaign abuses the Guest User identity that every Salesforce Experience Cloud site provisions for unauthenticated visitors. Against the legacy Aura framework, the actor's tooling calls the `getConfigData` and `getItems` Aura actions to automate enumeration of Accounts, Contacts, and Cases objects exposed to guest sharing rules; one victim organization's telemetry recorded over 560,000 such enumeration events across the campaign window. Against newer Lightning Web Runtime (LWR) sites, the tooling queries the GraphQL-based UI-API data layer and was observed systematically probing across API versions v56.0 through v66.0, while also probing self-registration flows for a path from unauthenticated guest access to an authenticated (self-registered) session. Against ServiceNow, the same toolset floods the Service Portal's effectively undocumented `POST /api/now/sp/search` endpoint to enumerate Knowledge Base articles and service-catalog items exposed to public/guest search, with both authenticated and unauthenticated probe requests returning HTTP 201. Researchers describe the tooling as a single custom Go binary capable of driving both the Salesforce and ServiceNow attack paths, distinguishing it from off-the-shelf tools such as AuraInspector.
Infrastructure has been unusually static for a scraping operation: the same IP (158.220.87.79, a Contabo GmbH VPS in Germany) and domain (city-forum.com, which gives the campaign its name) have been used without rotation for the full ~17-month duration, and scraping requests carry the Go-http-client/1.1 default User-Agent. Researchers explicitly decline to attribute the activity to a known actor or group ('We don't know who this is, and we're not ruling anyone in or out'), and are careful to distinguish City-Forum from the separate, earlier ShinyHunters campaign (publicly disclosed March 2026) that used a modified version of Mandiant's AuraInspector auditing tool against Salesforce Aura guest-access misconfigurations at 300-400 organizations — a related but distinct incident cited by researchers only for comparison.
No CVE applies: this is exploitation of customer-configured guest-user permissions (excessive object/field access, permissive sharing rules, self-registration exposure, and overly broad ServiceNow search-source/Knowledge-Base 'Can Read' settings), not a defect in either platform. Salesforce and Reco both published hardening guidance alongside the disclosure: disable the 'API Enabled' permission on guest profiles unless required, keep org-wide defaults Private with guest sharing rules capped to Read-only, disable unnecessary self-registration, and restrict ServiceNow Knowledge Base/Catalog visibility away from permissive 'Any User' settings.
Weaknesses (CWE)
CWE-284, CWE-668
Target sectors: telecoms, banking, financial services, enterprise software, public sector
Timeline
- City-Forum campaign infrastructure (domain city-forum.com and IP 158.220.87.79, a Contabo GmbH VPS in Germany) becomes active and begins guest-access enumeration of Salesforce Experience Cloud (Aura and LWR) and ServiceNow Service Portal sites; the same IP/domain pair is maintained without rotation for the full duration.
- Security research firm Reco publishes findings on the City-Forum campaign after roughly 17 months of sustained activity, documenting abuse of the Aura getConfigData/getItems API calls, GraphQL-based UI-API enumeration on Lightning Web Runtime sites probed across API versions v56.0-v66.0, and flooding of the ServiceNow Service Portal's undocumented POST /api/now/sp/search endpoint.
- Reco's telemetry shows the highest-volume identified victim organization logged over 560,000 guest-Aura enumeration events across the campaign window, nearly all of it automated guest-user Aura object enumeration.
- cybersecuritynews.com publishes coverage of the Reco research, disclosing the campaign's IOCs and Salesforce/ServiceNow mitigation guidance.
- SecurityWeek publishes a technical analysis of City-Forum, noting researchers explicitly withhold attribution ('We don't know who this is, and we're not ruling anyone in or out') and detailing the unified custom Go-binary toolset that distinguishes it from off-the-shelf tools like AuraInspector used in the separate, earlier ShinyHunters Salesforce Aura campaign.
- Reco and Salesforce publish mitigation guidance alongside the disclosure: audit guest sharing rules and self-registration settings on Experience Cloud, and restrict ServiceNow Knowledge Base 'Can Read' criteria away from permissive 'Any User' settings.
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 7 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
DATA_BREACH, HIGH, threat intelligence, cybersecurity, T1595.002, T1595.003, T1583.001, T1583.004, T1190, T1136.003, T1526, T1213.004, T1119, T1020
