City-Forum campaign raids Salesforce, ServiceNow portals

A data-theft campaign dubbed City-Forum has spent over a year raiding misconfigured Salesforce and ServiceNow portals worldwide, targeting telecoms, banks, and public-sector organizations. Reco traced the attacks to IP 158.220.87.79, hosted by Contabo, with activity continuing and increasing.