STORM-2035: Recidivist influence activity
Actor
We banned recidivist activity associated with the likely Iranian-linked operation that we originally disrupted last August, tracked in the industry as STORM-2035. The threat actor was prompting ChatGPT in Persian and generating batches of short comments in English and Spanish. The short comments were then posted on X by a series of likely inauthentic accounts that posed as residents of the target countries.
Behavior
The operation used ChatGPT to generate small batches of tweets, usually a dozen at a time, on a limited range of topics. Prompts were in Persian, and asked for outputs in Spanish or English.
The comments were then posted on X by accounts that posed as residents of the US, UK, Ireland and Venezuela. These accounts only posted comments generated by this operation. Each account followed far more accounts than it had followers. Many of the X accounts featured profile pictures of young women whose faces were obscured by their mobile phones or other items. Some of these profile pictures appear to have been copied from elsewhere on the internet, especially Pinterest.
One difference about this activity, compared with the original set of accounts we disrupted last year, is that the recidivist operators appear to have made greater efforts to keep different workstreams separate. The original activity featured content generation across X, Instagram and websites. The public-facing comments generated by this recidivism were only posted on X.
Completions
The operation generated comments about Latino rights in the US, Scottish independence, Irish reunification, Venezuela and Cuba, Palestinian rights, and Iran’s military and diplomatic prowess, which they portrayed as forcing the US to the negotiating table.
Comments on Latino rights, Iran, Cuba and Venezuela were in Spanish. Comments on Scotland and Ireland were in English. Comments on Palestinian rights were in both languages.
Latino rights
Scottish independence / UK criticism
Irish reunification
Venezuela / Cuba
Palestinian rights
Iran talks
Impact
Typical tweets by this operation recorded 150–350 views and zero likes, shares or comments. We did not identify instances where the comments we identified were amplified by other, real users into larger audiences.
Using the IO impact Breakout Scale(opens in a new window), we would assess this as Category 1: activity on one platform, with little evidence that real people picked up or widely shared their content.