threat-intel
Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset
High
Summary
A sophisticated and innovative campaign, dubbed ‘City-Forum,’ is targeting Salesforce and ServiceNow using a custom multi-platform toolset. The attackers are exploiting unauthenticated guest user access to gather data, primarily focusing on Salesforce Aura and newer LWR implementations, alongside a native ServiceNow Service Portal search endpoint. The campaign utilizes a single machine to minimize its footprint and employs stealthy techniques to avoid detection, with no evidence of a platform breach yet.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data