Mystery attacker spent a year raiding Salesforce and ServiceNow portals

Mystery attacker spent a year raiding Salesforce and ServiceNow portals

The headline suggests a smoking gun: a single threat actor, twelve months, two of the most widely deployed enterprise platforms on the planet. But the public record doesn't match the billing. No breach notification, no CISA advisory, no vendor bulletin has confirmed a year-long campaign targeting Salesforce and ServiceNow tenants specifically. What we have instead is a pattern — escalating, cross-platform, and increasingly brazen — that makes such a campaign not just plausible but probable.

Start with what's documented. Russian actors are impersonating Signal support to phishing-target high-value individuals. Microsoft's on-premises SharePoint sits exposed under active zero-day exploitation after patches failed to close the gap. Joomla sites running vulnerable extensions — iCagenda, Balbooa Forms — are being scored at perfect 10s on CVSS and exploited at scale. These aren't isolated incidents. They're the visible surface of a threat environment that has moved decisively from infrastructure to application layer, from opportunistic to persistent.

Salesforce and ServiceNow represent the crown jewels of that application layer. Between them they govern customer revenue, IT service delivery, HR workflows, and a staggering volume of regulated data. A Salesforce org often contains the full customer lifecycle — contracts, pricing, PII, communication history. ServiceNow holds the keys to IT operations: asset inventories, change records, credential stores, integration tokens. Compromise either and you don't just steal data. You gain the ability to manipulate business processes, inject fraudulent transactions, and persist undetected inside trusted workflows.

The attack surface is vast and routinely underestimated. Both platforms encourage extensive customization: Apex code, Flow automation, Lightning Web Components on the Salesforce side; Business Rules, UI Policies, Script Includes, and MID Server integrations on ServiceNow. Each customization is a potential logic flaw. Each integration — MuleSoft, Workato, custom REST endpoints — expands the perimeter. Neither vendor fully scans customer code for business-logic vulnerabilities. Their shared responsibility models explicitly place configuration hygiene on the tenant.

Credential reuse across these platforms is the norm, not the exception. SSO implementations frequently map the same identity provider to both systems. A compromised Okta or Azure AD token grants lateral movement. API tokens, often long-lived and over-scoped, sit in CI/CD pipelines, shared drives, and contractor laptops. The ServiceNow MID Server, designed to bridge on-prem and cloud, has historically been a weak link when exposed or misconfigured. Salesforce Connected Apps with "Full Access" scopes proliferate in partner ecosystems.

We've seen the precursors. In 2022, a threat group enumerated Salesforce Community Cloud sites via predictable URL patterns, then weaponized misconfigured Guest User sharing to harvest records. In 2023, researchers demonstrated ServiceNow widget injection via malicious Update Sets imported from untrusted update sources. Neither incident triggered the alarm it should have. Both were treated as configuration drift rather than campaign indicators.

The economics favor the attacker. A single successful Salesforce compromise at a Fortune 500 yields more actionable intelligence than ten thousand credential stuffing hits. ServiceNow access at a managed service provider cascades into every client tenant. The dwell time — a year, per the hypothesis — is entirely consistent with high-value targeting. This isn't ransomware's smash-and-grab. This is intelligence collection, process mapping, and selective exfiltration. The attacker doesn't need to encrypt. They need to understand the business well enough to simulate it.

Vendors have not been idle. Salesforce's Health Check, Event Monitoring, and Shield Platform Encryption raise the bar. ServiceNow's Vulnerability Response module, Instance Security Center, and new Application Security Testing framework signal intent. But adoption lags. Event Monitoring requires Enterprise licensing and dedicated analysts. Shield demands key management discipline most orgs lack. ServiceNow's security tooling is often disabled to preserve performance on legacy instances. The gap between feature availability and operational maturity is measured in years.

Third-party visibility remains fragmented. CASB solutions see API traffic but miss business-logic abuse. SIEM rules rarely parse Salesforce SOQL or ServiceNow GlideRecord queries for anomaly detection. Penetration testers seldom scope platform configuration reviews. The result: a blind spot the size of the enterprise SaaS estate.

If a year-long campaign exists — and the threat topology says it should — it won't be discovered by vendor alerts. It will surface when a deal desk notices a discount pattern that never existed, when a change advisory board sees an approved change that no one requested, when a revenue recognition audit finds a contract that never went through legal. The indicators are business anomalies, not security events.

The industry needs to stop treating SaaS tenants as vendor-secured black boxes. They're custom applications running on shared infrastructure, configured by customers, integrated by partners, and targeted by adversaries who understand the business value better than most security teams. Salesforce and ServiceNow are not the only targets. They're simply the highest-value ones with the largest attack surfaces and the least scrutiny.

Until security operations treat platform configuration as code, integrations as supply chain, and business logic as attack surface, the mystery attacker — or attackers — will keep their year-long lease. The portals aren't just raided. They're occupied.