Emerging ThreatsData Breaches

Salesforce, ServiceNow Portals Targeted in Ongoing Data Scraping Campaign

Analyst 207||Source: TheHackerNews
Modern cityscape with sleek and industrial buildings, subtle network lines in foreground.

158.220.87.79 — a single virtual private server hosted by Contabo — has been pulling records out of Salesforce and ServiceNow customer portals since at least March 2025, according to research published this week by agent security platform Reco.

The City Forum infrastructure

Reco has named the activity the "City Forum" campaign after a domain tied to that IP. Passive DNS shows the same domain resolving to 158.220.87.79 as far back as March 2025, and the server has not moved since. Every request from that host carries the same fingerprint: the default user agent of Go's net/http library, indicating the traffic originated from a compiled, purpose-built Go program rather than a browser.

Targets and scale observed

Reco identified targets across multiple sectors — telecoms, banks and other financial services firms, enterprise software vendors including security and data privacy companies, and public sector portals — though the firm did not name individual organizations. Aura-based guest traffic still represents the bulk of the volume observed; Reco notes one target logged more than 560,000 events from the same IP. Reco also reports the campaign's infrastructure remains active and that the volume of requests is climbing.

Three technical surfaces: Aura, Lightning UI-API, and ServiceNow search

What sets City Forum apart from previously reported Salesforce guest-access abuse is the range of surfaces it probes. Reco observed the actor using three distinct techniques from the same server.

  • Aura framework enumeration: High-volume guest requests that enumerate objects and page through records — the method used in several prior campaigns — account for the bulk of traffic.
  • Lightning Web Runtime / UI-API sweeps: The tool also queries Salesforce's newer Lightning Web Runtime sites through the UI-API, walking through API versions v56.0 through v66.0 in sequence. Reco notes the UI-API layer has little public write-up and no known scanning tools associated with it, making this behavior notable.
  • ServiceNow Service Portal search: The same server repeatedly targets a native ServiceNow endpoint, POST /api/now/sp/search, an entry point with almost no public documentation. Reco examined how the Service Portal search decides what an anonymous caller receives and found it can return significant data when guest access is permissive.

Detection guidance for Salesforce and ServiceNow

Reco lays out concrete steps defenders can use to spot live sweeps and historical abuse on both platforms.

  • Salesforce: Use Event Monitoring or Shield to pull AuraRequest and Sites log events. Filter for the Go-http-client user agent, requests from 158.220.87.79, and request paths containing /webruntime/api/services/data. Reco also highlights spikes in self-registration attempts at /SiteRegister and /CommunitiesSelfReg as a correlated signal.
  • ServiceNow: Inspect the transaction log table syslog_transaction. Filter by source IP and by URLs starting with /api/now/sp/search. Reco identifies guest-created rows and unusual output length as clear indicators of a live sweep.

Remediation and what this means for security teams, procurement leaders, and end users

Reco emphasizes that the underlying endpoints are working as designed; the root issue is an overprivileged persistent guest identity. On both platforms the guest user cannot be deleted — it can only be restricted — so remediation focuses on tightening that profile.

  • Security teams: Review guest sharing rules and strip unnecessary object and field-level access from the guest profile. Disable self registration where not required and turn off the Experience Builder setting that allows guest users to reach public APIs in Salesforce. In ServiceNow, map which search sources are exposed to public portals and audit Knowledge Base read criteria to limit what anonymous searches can return.
  • Procurement and risk leaders: Expect that app-exposure risk can surface through multiple API surfaces, not only legacy UI frameworks. Reco also offers a planning framework in its guide to AI security investment for sizing budget, evaluating vendors, and building a business case — material the firm positions as relevant for deciding how much to invest in closing these exposure gaps versus other priorities.
  • End users and the public: Where guest profiles are lax, records that appear to require login can effectively be public if the guest identity has read rights; tightening guest access is the practical mitigation.

Reco has not attributed City Forum to any named group. The firm's full technical breakdown, with request signatures, sample queries, and a deeper look at the Service Portal search behavior, is available in its writeup. For defenders with Salesforce Event Monitoring, Shield, or ServiceNow transaction logs, the guidance in that writeup provides specific, actionable starting points to detect and restrict this long-running sweep.

Original reporting

Cloud SecurityEmerging ThreatsSalesforceServicenowGo-based MalwareData ScrapingCity ForumCustomer PortalsRecoContabo
Related Intelligence

Continue Reading

Cluttered software development workspace with laptop, coding materials, and RubyGems packages in a bright, neutral-colored…

Typosquatting Campaign Targets RubyGems Users with Windows Stealer

Beware of a sneaky typosquatting campaign targeting RubyGems users: 16 malicious packages were used to spread a Windows stealer that harvests sensitive data, including browser credentials, cryptocurrency wallets, and Telegram info. This malware can strike when you least expect it, putting your online security at risk.

Analyst 207
University building with students and staff, subtle tech infrastructure visible.

Cyber Incident Disrupts UT San Antonio's Student Services

The University of Texas at San Antonio swiftly contained a potential cyber threat after detecting suspicious activity on the edge of its network, and took swift action to protect its systems and data. Thankfully, the incident appears to have been effectively managed, with no evidence of data compromise reported so far.

Analyst 207
Empty office interior with cubicles, private offices, and scattered papers, lit by soft daylight through windows.

Ransomware Attacks Singly Target Mid-Market Firms

Ransomware attacks are hitting mid-market firms with alarming frequency, and the threat is only escalating as AI-powered tools rapidly uncover new vulnerabilities at an overwhelming pace. Mid-market companies, with revenues between $10m and $1bn, now account for nearly three-quarters of ransomware attack victims.

Analyst 207
Cluttered office workstation with laptop and monitor on desk.

Ransomware gangs exploit Windows Task Host flaw

Ransomware gangs are exploiting a high-severity flaw in Windows Task Host, a core component that could allow them to escalate privileges and wreak havoc on your system. This vulnerability, already patched by Microsoft, poses significant risks to users, especially those with basic user permissions.

Analyst 207