A long-running data theft campaign, dubbed "City-Forum," has been reported to be actively targeting organizations utilizing Salesforce and ServiceNow platforms. The campaign has been observed since at least March 2025 and is characterized by its use of custom tooling to exfiltrate data.
The "City-Forum" campaign appears to focus on the unauthorized extraction of sensitive information from instances of these widely used enterprise cloud platforms. While the specific data types being targeted were not detailed, such platforms commonly store a broad array of business-critical information, including customer data, financial records, intellectual property, and operational metrics. The use of custom tooling suggests a degree of sophistication and tailored effort by the threat actors to bypass standard security controls or exploit specific configurations within the targeted environments.
Salesforce and ServiceNow are prominent Software-as-a-Service (SaaS) providers, offering CRM and IT service management solutions, respectively. Their extensive adoption across various industries makes them attractive targets for adversaries seeking access to a centralized repository of organizational data. Attacks against such platforms often leverage compromised credentials, misconfigurations, or vulnerabilities in integrated third-party applications to gain initial access.
Once access is established, threat actors typically employ techniques to maintain persistence, escalate privileges, and ultimately exfiltrate data. The "custom tooling" mentioned in the report could encompass a range of malicious scripts, applications, or modified legitimate tools designed to automate data collection, obfuscate exfiltration channels, or evade detection by security monitoring systems. The long-running nature of the campaign indicates a sustained effort and potentially a low-and-slow approach to avoid triggering alerts.
Organizations using Salesforce and ServiceNow are generally advised to implement robust security practices. This includes enforcing strong multi-factor authentication (MFA) for all users, regularly reviewing and auditing user permissions, especially for administrative accounts, and ensuring that all platform configurations adhere to security best practices. Continuous monitoring of platform activity logs for unusual access patterns, data downloads, or API calls is also crucial for early detection of compromise.
Furthermore, organizations should pay close attention to the security of any third-party applications integrated with their Salesforce or ServiceNow instances, as these can sometimes serve as vectors for compromise. Regular security assessments, penetration testing, and vulnerability management programs for both the platforms themselves and their integrations are essential to identify and remediate potential weaknesses before they can be exploited.
The "City-Forum" campaign underscores the persistent threat of data exfiltration targeting critical enterprise cloud services. As organizations increasingly rely on SaaS platforms to manage core business functions, the security of these environments becomes paramount. This incident highlights the ongoing need for vigilance, proactive security measures, and a comprehensive understanding of the attack surface presented by cloud-based applications.
