STORM-0817: Iran-linked malware and scraping activity

This case study was originally published in OpenAI’s October 2024⁠(opens in a new window) report.

Actor

We disrupted a network of accounts operated by an Iran-based threat actor, which based on an assessment from a credible source is attributable to STORM-0817. We believe this is the first time this actor has been publicly identified as using AI models.

Behavior

This actor used our models to debug malware, for coding assistance in creating a basic scraper for Instagram, and to translate LinkedIn profiles into Persian. This included working on malware that was still in development, and looking for information on potential targets.

These behaviors gave us unique insights into this adversary’s operations, including into infrastructure and capabilities that were being developed and weren’t yet fully operational.

Completions

STORM-0817 asked our models for debugging and coding support in implementing Android malware and the corresponding command and control infrastructure. The malware targeted Android and was relatively rudimentary. Code snippets in attacker supplied prompts indicated it had standard surveillanceware capabilities and could retrieve:

• Contacts

• Call logs

• Installed packages

• Media on external storage

• Screenshots

• Device IMEI and model

• Browsing history

• Latitude / longitude

• Files off external storage (pdf, excel docs)

• Content downloaded to external storage including files sent by secure messaging apps like WhatsApp and IMO.

STORM-0817 was using this code in two Android packages—com.example.myttt and com.mihanwebmaster.ashpazi.

In parallel, STORM-0817 used ChatGPT to support the development of server side code necessary to handle connections from compromised devices. This allowed us to see that the command and control server for this malware is a WAMP (Windows, Apache, MySQL & PHP/Perl/Python) setup and during testing was using the domain stickhero[.]pro.

Some examples of these interactions and their associated TTP categories are below: