TLDR Tech / IT
An Advanced Attacker Is Targeting Salesforce and ServiceNow
There is an ongoing campaign targeting guest-accessible Salesforce Experience Cloud sites and ServiceNow Service Portals from infrastructure linked to the IP address 158.220.87[.]79. The actor uses Salesforce Aura and previously undocumented Salesforce LWR UI-API techniques, plus a ServiceNow search endpoint, to extract records.
Read the full story