Iranian influence nexus: Cross-platform activity

This case study was originally published in OpenAI’s February 2025⁠(opens in a new window) report.

Actor

We banned five ChatGPT accounts that generated a small number of tweets and articles that were then posted on third party assets publicly linked to known Iranian influence operations. One of these operations is known as the International Union of Virtual Media, or IUVM⁠(opens in a new window); Microsoft reported⁠(opens in a new window) the other as STORM-2035. We disrupted and reported earlier activity by these two operations last year.

These two operations have previously been reported as separate efforts, but we found that one account that we banned was used to generate content for both of them. While small in scale, this suggests a potential previously unreported relationship, at least on the operator level.

Behavior

The ChatGPT accounts generated a range of content for different online entities linked to previously reported Iranian influence operations. Four of the five generated content that was published by entities connected to STORM-2035 by a range of analysts; the fifth generated some content published by entities publicly connected to STORM-2035, and some published by a website connected to IUVM.

One ChatGPT account used our models to generate long-form articles that were then posted on a website called al-sarira[.]com, publicly linked to STORM-2035. Two other ChatGPT accounts used our models to generate tweets that were posted by the al-Sarira domain’s X account, and by two other X accounts.

STORM-2035 is a wide-ranging operation, with websites reported by the open-source community in Arabic, French, and Spanish, as well as English. A fourth ChatGPT account used our models to generate a small number of Spanish-language articles for another website identified by public research⁠(opens in a new window), lalinearoja[.]net.