The City-Forum threat actor, responsible for persistent City-Forum data theft attacks, has been traced to a single IP address, 158.220.87.79, hosted by Contabo and resolving to city-forum.com. This persistent point of origin has been active for over 17 months as of August 2026. While a single IP might suggest easy detection, the attacker's methodology complicates identification and defense.
At its core, this campaign exploits a common misconfiguration: organizations exposing sensitive data through overly permissive Salesforce and ServiceNow portal settings to unauthenticated guest users. This is not an inherent flaw in either Salesforce or ServiceNow platforms, but rather a site owner's error. The attacker then deploys a custom, multi-platform Go binary to systematically enumerate and exfiltrate this exposed data, a clear instance of City-Forum data theft. Their consistent user agent, Go-http-client/1.1, leaves a clear forensic trail.
How a Single IP Became a Persistent Data Siphon
What makes this attack sophisticated isn't complex bypasses, but rather the methodical, targeted exploitation of basic misconfigurations. The actor does not rely on generic scripts; instead, they conduct deep reconnaissance.
For Salesforce Experience Cloud, City-Forum targets both the older Aura framework and newer Lightning Web Runtime (LWR) implementations.
Aura Exploitation
The attacker queries /aura or /s/sfsites/aura endpoints. They invoke HostConfigController.getConfigData to list publicly accessible objects such as Accounts, Contacts, and Cases. Subsequently, SelectableListDataProviderController.getItems is used to extract records from these objects. This enumeration of publicly accessible objects aligns with MITRE ATT&CK T1595.002 (Active Scanning: Vulnerability Scanning), where attackers actively probe for exposed information, a key component of City-Forum data theft tactics. The SaaS security firm Reco observed one target logging over 560,000 guest Aura enumeration events from this single IP, indicating significant data extraction.
LWR GraphQL Attacks
City-Forum represents the first observed in-the-wild exploitation of Salesforce's UI-API guest surface specifically for LWR. The actor sends GraphQL requests to /webruntime/api/services/data/{version}/graphql to exfiltrate data exposed to guest accounts. This enumeration technique also aligns with MITRE ATT&CK T1595.002 (Active Scanning: Vulnerability Scanning), further demonstrating the scope of City-Forum data theft. This method is not present in common public attack tools like AuraInspector, demonstrating a deeper understanding of the platform's newer interfaces.
Self-Registration Enumeration
Beyond data theft, the actor probes /SiteRegister and /CommunitiesSelfReg to identify enabled self-registration. Probing for self-registration capabilities (e.g., MITRE ATT&CK T1078.003 - Valid Accounts: Cloud Accounts or T1589 - Gather Victim Identity Information) indicates an intent to escalate privileges from unauthenticated guest to authenticated external accounts, gaining broader access.
For ServiceNow Service Portals, the attacker targets a specific, less-documented endpoint.
ServiceNow Search Endpoint Exploitation
They send POST requests to /api/now/sp/search?sysparm_cancelable=true. This exploits ServiceNow's portal search functionality when search sources permit guest access. The attacker varies search terms to enumerate exposed information, a form of MITRE ATT&CK T1595.002 (Active Scanning: Vulnerability Scanning). A critical issue here is that ServiceNow transaction logs do not record the POST body, preventing defenders from easily identifying the specific search queries. This significantly complicates detection and forensic analysis.
This campaign differs from the ShinyHunters operation in March 2026, which focused exclusively on Salesforce Aura using modified AuraInspector tools. City-Forum's multi-platform approach, custom tooling, and targeting of less-documented interfaces represent a more advanced and persistent threat, characteristic of sophisticated City-Forum data theft operations.
The Practical Impact: Your Customer Data, Exposed by City-Forum Data Theft
Victims span multiple sectors globally, including a regional telecom provider, a mid-sized financial institution, enterprise software vendors (even security and data privacy firms), and public-sector entities. The exfiltrated data comprises any information inadvertently exposed to anonymous users via portal configurations, a direct result of City-Forum data theft.
The exfiltration method involves high-volume, yet protocol-legitimate, traffic. This technique, aligning with MITRE ATT&CK T1041 (Exfiltration Over C2 Channel) or T1048 (Exfiltration Over Alternative Protocol), allows it to bypass many anomaly detection systems, making identification challenging. We have, to date, only observed guest user activities. However, the potential for privilege escalation to authenticated access in Salesforce, should self-registration be enabled, remains a distinct risk.
Immediate Actions for Salesforce and ServiceNow Security
This issue is not a platform vulnerability but a widespread configuration oversight. Addressing it requires immediate, targeted action.
For Salesforce Administrators, a rigorous review of guest user permissions is essential.
Guest User Permissions
Scrutinize guest-user sharing rules, object and field permissions, file access, and member visibility settings. Treat guest users as potentially malicious actors and restrict access to only what is strictly necessary.
Self-Registration
Disable self-registration if not explicitly required. The attacker's probing of /SiteRegister and /CommunitiesSelfReg indicates an intent to escalate privileges.
LWR API Access
For LWR sites, verify Experience Builder options. If guest users do not require public API access, disable this setting. This action directly mitigates GraphQL data enumeration and exfiltration attempts.
For ServiceNow Administrators, focus on search source security.
Search Source Audit
Conduct a thorough audit of every search source exposed via your Service Portals.
Access Controls
Implement stringent authentication and access controls for any search sources that could expose sensitive data. Unrestricted guest search access effectively grants data exfiltration capability.
This campaign highlights that attack efficacy often stems from patient, methodical exploitation of common misconfigurations, rather than zero-day vulnerabilities. The custom, stealthy tooling used by City-Forum allows these activities to persist undetected. This incident underscores the critical importance of treating guest access configurations with the same security rigor as authenticated user access, given their direct vector to sensitive data and the ongoing threat of City-Forum data theft.
