City-Forum Campaign Targets Salesforce, ServiceNow Data

TL;DR. A new data theft campaign, dubbed City-Forum, exploits misconfigured Salesforce and ServiceNow customer portals to steal exposed data from guest accounts. - The attacks leverage custom tools and infrastructure to enumerate and exfiltrate records from unauthenticated guest user access. - These attacks are ongoing and exploit misconfigurations, not vulnerabilities, affecting various global organizations. - Reco, a SaaS security firm, identified the campaign originating from a single IP address with consistent attack patterns.

• City-Forum data theft campaign targets Salesforce and ServiceNow.
• Attacks exploit misconfigured guest user permissions, not software vulnerabilities.
• Custom tools are used to enumerate and steal data from exposed customer portals.
• The campaign is active, affecting banks, telcos, and public sector organizations globally.

Back to QLANKR News