One Attacker Scrapes Salesforce and ServiceNow Portals

A recent research study by Reco has uncovered a concerning trend in cybersecurity threats. A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year.

The activity, which Reco has named the City Forum campaign, traces back to one server: 158.220.87.79, hosted on a commodity VPS through the German provider Contabo. Every request from that server carries the same fingerprint, the default user agent of Go's net/http library, which tells researchers the tool behind it is a compiled, purpose-built program rather than anything run from a browser.

The targets identified so far span telecoms, banks and other financial services firms, enterprise software vendors including security and data privacy companies, and public sector portals. However, Reco has not named individual organizations.

The City Forum campaign is distinct from prior Salesforce guest access abuse, including the widely reported activity attributed to ShinyHunters. What sets this campaign apart is the range of surfaces it touches. Most known attackers in this space lean on Salesforce's older Aura framework, sending high volumes of guest requests to enumerate objects and page through records. However, the tool behind the City Forum campaign also reaches Salesforce's newer Lightning Web Runtime sites through the UI-API, a data layer that has no public write-ups or known scanning tools associated with it.

The same server also hammers a native ServiceNow Service Portal search endpoint, POST /api/now/sp/search, that carries almost no public documentation of its own.

According to Reco's research, the common thread across every technique is the same underlying issue: a guest identity that was granted more access than the site actually needed to serve the public. Salesforce Experience Cloud sites and ServiceNow portals both maintain a persistent guest user that unauthenticated visitors execute as, and that user cannot be deleted, only restricted.

The research lays out concrete detection steps for security and IT teams on both platforms. On Salesforce, defenders with Event Monitoring or Shield can pull AuraRequest and Sites log events and look for the Go-http-client user agent, the specific IP, and request paths containing /webruntime/api/services/data, alongside spikes in self-registration attempts at /SiteRegister and /CommunitiesSelfReg.

On ServiceNow, the transaction log table syslog_transaction can be filtered by source IP and by URLs starting with /api/now/sp/search, with guest created rows and unusual output length flagged as the clearest signal of a live sweep.

Remediation, per the research, centers on tightening the guest profile rather than the endpoints themselves, since both the UI-API and the ServiceNow search endpoint are working as designed. On Salesforce, that means reviewing guest sharing rules, stripping unnecessary object and field-level access from the guest profile, disabling self-registration where it is not required, and turning off the Experience Builder setting that allows guest users to reach public APIs.

On ServiceNow, the fix is mapping which search sources are exposed to public-facing portals and auditing the Knowledge Base read criteria that decide what an anonymous search actually returns.

Reco says the infrastructure behind the campaign is still active and the volume is climbing, and the firm has not attributed the activity to a specific named group.

### Detection and Remediation

To detect and remediate the City Forum campaign, security and IT teams can follow these steps:

- On Salesforce, pull AuraRequest and Sites log events and look for the Go-http-client user agent, the specific IP, and request paths containing /webruntime/api/services/data, alongside spikes in self-registration attempts at /SiteRegister and /CommunitiesSelfReg. - On ServiceNow, filter the transaction log table syslog_transaction by source IP and by URLs starting with /api/now/sp/search, with guest created rows and unusual output length flagged as the clearest signal of a live sweep. - On Salesforce, review guest sharing rules, strip unnecessary object and field-level access from the guest profile, disable self-registration where it is not required, and turn off the Experience Builder setting that allows guest users to reach public APIs. - On ServiceNow, map which search sources are exposed to public-facing portals and audit the Knowledge Base read criteria that decide what an anonymous search actually returns.

### Conclusion

The City Forum campaign highlights the importance of tightening guest profiles and monitoring for suspicious activity on both Salesforce and ServiceNow platforms. By following the detection and remediation steps outlined in Reco's research, security and IT teams can protect their organizations from this type of attack.