Salesforce, ServiceNow data targeted in ‘City-Forum’ attacks
Summary
Researchers at Reco have identified a new campaign named 'City-Forum' targeting data within Salesforce and ServiceNow systems. This campaign, which bears similarities to past attacks by the ShinyHunters group, utilizes a novel UI-API layer penetration method and custom toolset. The attackers have demonstrated advanced tactics by mapping common data-leak vectors within the targeted services.
IFF Assessment
This article details a new attack campaign targeting sensitive data in cloud-based CRM and IT service management platforms, posing a direct threat to organizations and their user data.
Defender Context
Defenders should be aware of the 'City-Forum' campaign targeting Salesforce and ServiceNow, as it represents an advanced persistent threat. Organizations need to scrutinize access controls and monitor for unusual activity within these critical systems, especially concerning the UI-API layer and Service Portal search endpoints.