STEALTHY ‘CITY-FORUM' ATTACKS TARGET SALESFORCE AND SERVICENOW WITH CUSTOM TOOLSET

Summary from the TLDR InfoSec newsletter

Reco tracked City-Forum using one Go binary against Salesforce Aura, Salesforce LWR, and ServiceNow. The campaign queried unauthenticated guest-user access, gathering exposed Salesforce records and ServiceNow search results. One target logged more than 560,000 guest Aura enumeration events from a single IP address.