OpenAI has taken action against accounts operated by STORM-0817, an Iran-based threat actor. The company identified and disabled these accounts, which were using OpenAI's AI models for various malicious activities, including debugging Android malware and developing scraping tools. This case study was initially published in OpenAI’s October 2024 report.
This marks the first public identification of STORM-0817 using AI models, according to OpenAI. The actor leveraged AI for tasks such as coding assistance for an Instagram scraper and translating LinkedIn profiles into Persian. These interactions provided OpenAI with insights into STORM-0817's developing infrastructure and capabilities.
Key Points
- OpenAI banned accounts linked to the Iran-based threat actor STORM-0817.
- STORM-0817 used OpenAI's models to debug Android malware and its command and control infrastructure.
- The actor also sought coding assistance for an Instagram profile scraper using ChatGPT.
- STORM-0817 translated LinkedIn profiles of Pakistani cybersecurity professionals into Persian.
- The malware targeted Android devices and had standard surveillanceware capabilities.
- The command and control server for the malware was identified as a WAMP setup using the domain stickhero[.]pro.
- OpenAI shared relevant Indicators of Compromise (IOCs) with industry partners.
Context
According to OpenAI, STORM-0817 utilized their models to debug rudimentary Android malware, which included code snippets indicating surveillanceware capabilities. The actor also used ChatGPT to develop server-side code for handling connections from compromised devices, revealing a WAMP server setup and the domain stickhero[.]pro. Additionally, STORM-0817 sought help to debug a Python-based Instagram scraper, which was tested on an Iranian journalist critical of the Iranian government. The actor also translated LinkedIn profiles of individuals from Pakistan's National Center for Cyber Security and the National Cybercrime and Forensics Lab into Persian.
Why It Matters
This incident highlights how threat actors are incorporating AI models into their operations, even for tasks that might be achievable with non-AI tools. For builders and security practitioners, it underscores the importance of monitoring AI platform usage for suspicious activities and collaborating on threat intelligence to counter evolving tactics.
What To Do
- Note the identified STORM-0817 tactics, techniques, and procedures (TTPs).
- Review the IOCs shared by OpenAI to enhance detection capabilities.
- Watch for similar patterns of AI model misuse in debugging, scraping, and translation tasks.
- Compare the capabilities observed with STORM-0817 to other publicly available threat intelligence.