Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset
Summary
Researchers have identified a new campaign dubbed 'City-Forum' that targets Salesforce and ServiceNow platforms. The attacks leverage unauthenticated guest access to surreptitiously enumerate and exfiltrate data from these systems.
IFF Assessment
FOE
This campaign represents a novel attack method that targets business-critical platforms, posing a direct threat to data confidentiality and integrity for organizations using these services.
Defender Context
Defenders should be aware of the 'City-Forum' campaign and the tactic of exploiting unauthenticated guest access to cloud platforms. Monitoring for unusual data enumeration or exfiltration activity on Salesforce and ServiceNow instances is crucial, especially if guest access is enabled.