Long-running Data Theft Campaign Targeting Salesforce, ServiceNow

Researchers at Reco have identified a campaign named "City-Forum" in which an unknown, advanced threat actor has for over a year used custom tooling to probe misconfigured Salesforce (including LWR data-access surfaces) and ServiceNow service portals to exfiltrate potentially sensitive data across multiple sectors worldwide; Reco published indicators and specific mitigation and hunting guidance for affected customers.