Long-running Data Theft Campaign Targeting Salesforce, ServiceNow
Summary
A long-running data theft campaign, dubbed "City-Forum," has been active since at least March 2025. The campaign has specifically targeted organizations using Salesforce and ServiceNow platforms with custom tools.
IFF Assessment
FOE
The campaign focuses on data theft, which directly harms organizations and individuals by compromising sensitive information.
Defender Context
Defenders should be aware of the "City-Forum" campaign, particularly if their organization utilizes Salesforce or ServiceNow. Monitoring for custom tooling and unusual access patterns targeting these platforms is crucial. The longevity of the campaign suggests sophisticated evasion techniques, requiring robust threat hunting and detection capabilities.