Salesforce, ServiceNow data targeted in ‘City-Forum’ attacks
ID: 725cef42-7c42-5d72-9a14-a515e654c4c1
STIX ID: report--725cef42-7c42-5d72-9a14-a515e654c4c1
Feed Name: CIO Security
Threat Score
Researchers at Reco report an active campaign called “City-Forum” that has breached Salesforce and ServiceNow systems, leaving user data exposed. The activity resembles prior ShinyHunters extortion attacks but uses novel techniques—penetration via the UI-API layer and a targeted ServiceNow Service Portal search endpoint—and a bespoke attacker toolset.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.