"City-Forum" Campaign Mass-Enumerates Salesforce Experience Cloud and ServiceNow Portals via Guest Access
"City-Forum" Campaign Mass-Enumerates Salesforce Experience (TL-2026-1999), also tracked as City-Forum, is a high-severity data breach, first published 2026-08-12. It has no confirmed attribution, affects Salesforce Experience Cloud (Aura Framework), maps to 10 MITRE ATT&CK techniques (T1020, T1119, T1136.003), and is covered by 9 detection rules and 7 indicators of compromise.
Key facts for TL-2026-1999
- Threat ID
- TL-2026-1999
- Also known as
- City-Forum, City-Forum Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- 2026-08-12
- Last reviewed
- 2026-08-12
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecoms, banking, financial services, enterprise software, public sector
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in "City-Forum" Campaign Mass-Enumerates Salesforce Experience
Malware and tooling: Custom Go binary (unnamed City-Forum toolset)
A ~17-month, unattributed data-harvesting campaign dubbed 'City-Forum' abuses overly permissive Guest User access on Salesforce Experience Cloud (Aura and Lightning Web Runtime) and ServiceNow Service Portal sites to enumerate and scrape exposed records at scale, with one victim organization logging over 560,000 enumeration events. No CVE or platform vulnerability is involved; the campaign exploits customer-side guest-access misconfiguration only.
How "City-Forum" Campaign Mass-Enumerates Salesforce Experience works
City-Forum is a large-scale, cross-platform data-harvesting campaign first identified by security research firm Reco and reported publicly on 2026-08-12 by cybersecuritynews.com and SecurityWeek. The campaign has been continuously active since at least March 2025 (roughly 17 months at time of disclosure), targeting telecommunications providers, banks and financial-services firms, enterprise software vendors (including security and data-privacy companies), and public-sector portals. It is notable as the first observed in-the-wild exploitation of Salesforce's UI-API guest surface, and for operating a single unified toolset against two separate SaaS platforms simultaneously rather than a platform-specific script.
Mechanically, the campaign abuses the Guest User identity that every Salesforce Experience Cloud site provisions for unauthenticated visitors. Against the legacy Aura framework, the actor's tooling calls the `getConfigData` and `getItems` Aura actions to automate enumeration of Accounts, Contacts, and Cases objects exposed to guest sharing rules; one victim organization's telemetry recorded over 560,000 such enumeration events across the campaign window. Against newer Lightning Web Runtime (LWR) sites, the tooling queries the GraphQL-based UI-API data layer and was observed systematically probing across API versions v56.0 through v66.0, while also probing self-registration flows for a path from unauthenticated guest access to an authenticated (self-registered) session. Against ServiceNow, the same toolset floods the Service Portal's effectively undocumented `POST /api/now/sp/search` endpoint to enumerate Knowledge Base articles and service-catalog items exposed to public/guest search, with both authenticated and unauthenticated probe requests returning HTTP 201. Researchers describe the tooling as a single custom Go binary capable of driving both the Salesforce and ServiceNow attack paths, distinguishing it from off-the-shelf tools such as AuraInspector.
Infrastructure has been unusually static for a scraping operation: the same IP (158.220.87.79, a Contabo GmbH VPS in Germany) and domain (city-forum.com, which gives the campaign its name) have been used without rotation for the full ~17-month duration, and scraping requests carry the Go-http-client/1.1 default User-Agent. Researchers explicitly decline to attribute the activity to a known actor or group ('We don't know who this is, and we're not ruling anyone in or out'), and are careful to distinguish City-Forum from the separate, earlier ShinyHunters campaign (publicly disclosed March 2026) that used a modified version of Mandiant's AuraInspector auditing tool against Salesforce Aura guest-access misconfigurations at 300-400 organizations — a related but distinct incident cited by researchers only for comparison.
No CVE applies: this is exploitation of customer-configured guest-user permissions (excessive object/field access, permissive sharing rules, self-registration exposure, and overly broad ServiceNow search-source/Knowledge-Base 'Can Read' settings), not a defect in either platform. Salesforce and Reco both published hardening guidance alongside the disclosure: disable the 'API Enabled' permission on guest profiles unless required, keep org-wide defaults Private with guest sharing rules capped to Read-only, disable unnecessary self-registration, and restrict ServiceNow Knowledge Base/Catalog visibility away from permissive 'Any User' settings.
MITRE ATT&CK techniques used in TL-2026-1999
Exfiltration
Collection
T1119 Automated Collection; T1213.004 Customer Relationship Management Software
Persistence
Initial Access
T1190 Exploit Public-Facing Application
Discovery
Resource Development
T1583.001 Domains; T1583.004 Server
Reconnaissance
T1595.002 Vulnerability Scanning; T1595.003 Wordlist Scanning
Affected products and versions in "City-Forum" Campaign Mass-Enumerates Salesforce Experience
- Salesforce — Experience Cloud (Aura Framework)
Vulnerable versions: Any org/site with misconfigured Guest User sharing rules, object permissions, or field-level security
Fixed in: N/A - customer-side configuration hardening, not a platform version fix - Salesforce — Lightning Web Runtime (LWR) / UI-API
Vulnerable versions: UI-API versions v56.0 through v66.0 observed probed; any LWR site with exposed guest GraphQL/UI-API access
Fixed in: N/A - customer-side configuration hardening, not a platform version fix - ServiceNow — Service Portal
Vulnerable versions: Instances exposing Knowledge Base/catalog search via POST /api/now/sp/search to public or guest users
Fixed in: N/A - customer-side configuration hardening, not a platform version fix
Remediation for "City-Forum" Campaign Mass-Enumerates Salesforce Experience
Immediate actions
- Audit and restrict Salesforce Experience Cloud Guest User sharing rules, object permissions, and field-level security; remove the 'API Enabled' permission from guest profiles unless explicitly required
- Disable self-registration on public-facing Experience Cloud sites where it is not operationally required, to prevent unauthenticated-to-authenticated escalation
- Review ServiceNow Service Portal Knowledge Base and Catalog 'Can Read' criteria and remove overly permissive 'Any User'/public settings
- Block or alert on inbound/outbound traffic to/from 158.220.87.79 and any references to city-forum.com at the network and WAF perimeter
Workarounds
- Grant public access at the individual page level in Experience Builder instead of exposing an entire site publicly
- Where guest Aura/API access cannot be fully disabled, remove unused Visualforce and self-registration pages and cap guest page-level access to only what is required
Longer-term hardening
- Run Salesforce's Guest User Access / Health Check reporting on a recurring cadence to catch guest-sharing-rule and field-level-security drift
- Set org-wide defaults to Private for all objects and enforce Read-only as the maximum access granted by any guest user sharing rule
- Instrument SIEM/WAF detections for high-volume Aura getConfigData/getItems and LWR UI-API GraphQL calls from a single source IP, and for repeated automated POST requests to /api/now/sp/search
- Adopt continuous guest-access configuration monitoring (e.g. an AppExchange guest-access monitoring package) rather than point-in-time audits
Weaknesses (CWE) in "City-Forum" Campaign Mass-Enumerates Salesforce Experience
CWE-284, CWE-668
Timeline of "City-Forum" Campaign Mass-Enumerates Salesforce Experience
- City-Forum campaign infrastructure (domain city-forum.com and IP 158.220.87.79, a Contabo GmbH VPS in Germany) becomes active and begins guest-access enumeration of Salesforce Experience Cloud (Aura and LWR) and ServiceNow Service Portal sites; the same IP/domain pair is maintained without rotation for the full duration.
- Reco and Salesforce publish mitigation guidance alongside the disclosure: audit guest sharing rules and self-registration settings on Experience Cloud, and restrict ServiceNow Knowledge Base 'Can Read' criteria away from permissive 'Any User' settings.
- SecurityWeek publishes a technical analysis of City-Forum, noting researchers explicitly withhold attribution ('We don't know who this is, and we're not ruling anyone in or out') and detailing the unified custom Go-binary toolset that distinguishes it from off-the-shelf tools like AuraInspector used in the separate, earlier ShinyHunters Salesforce Aura campaign.
- cybersecuritynews.com publishes coverage of the Reco research, disclosing the campaign's IOCs and Salesforce/ServiceNow mitigation guidance.
- Reco's telemetry shows the highest-volume identified victim organization logged over 560,000 guest-Aura enumeration events across the campaign window, nearly all of it automated guest-user Aura object enumeration.
- Security research firm Reco publishes findings on the City-Forum campaign after roughly 17 months of sustained activity, documenting abuse of the Aura getConfigData/getItems API calls, GraphQL-based UI-API enumeration on Lightning Web Runtime sites probed across API versions v56.0-v66.0, and flooding of the ServiceNow Service Portal's undocumented POST /api/now/sp/search endpoint.
Sources cited for "City-Forum" Campaign Mass-Enumerates Salesforce Experience
- Salesforce and ServiceNow Targeted in Attacks
- Stealthy 'City-Forum' Attacks Target Salesforce and ServiceNow With Custom Toolset
- Reco Blog: AI Agent Security News, Research & Insights
- ShinyHunters Utilize Public Audit Tool to Scan for Vulnerable Salesforce Aura Instances
- Best Practices and Considerations When Configuring the Guest User Profile
- Protecting Your Data: Essential Actions to Secure Experience Cloud Guest User Access
- ShinyHunters claims ongoing Salesforce Aura data theft attacks
- ShinyHunters 'Breach 400 Companies' via Salesforce Experience Cloud
Threats related to "City-Forum" Campaign Mass-Enumerates Salesforce Experience
Detection coverage for TL-2026-1999
As of 2026-08-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1999 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.