JA EN
shiichan

Surprise Targets: Cybersecurity Pros! OpenAI Takes Down Iran-Linked Hacking Group STORM-0817

OpenAI News ★★★ View Markdown
#openai#ai-safety#security

Hey, it's Shiichan! I found a slightly unsettling cybersecurity story today, so let's dig in.

OpenAI News openai.com

What was announced?

OpenAI's News page announced that it banned accounts linked to STORM-0817, an Iran-based hacking group. A trusted source attributed the activity to STORM-0817, and this marks the first time this particular actor has been publicly identified as using AI models.

Why it matters

STORM-0817 builds spyware for Android devices, and ChatGPT was woven right into that development work. Its targets included a journalist critical of the Iranian government and cybersecurity professionals in Pakistan. When people hear "AI misuse," they usually picture large-scale scams or fake news. This case is more down-to-earth and hands-on: AI showing up in the actual day-to-day grind of malware development.

What changes

OpenAI banned the accounts tied to STORM-0817 and shared indicators of compromise (IOCs) with industry partners. That said, OpenAI's own assessment was that the AI models only offered "limited, incremental capabilities" beyond what's already achievable with publicly available, non-AI tools, so this wasn't an attack that AI made possible on its own.

Dive Deep

Here's how OpenAI observed ChatGPT being used:

  • Debugging Android malware code still in development
  • Helping build an Instagram scraper using the Selenium webdriver
  • Translating LinkedIn profiles into Persian
  • Assisting with server-side command-and-control (C2) infrastructure

The malware itself was a serious piece of spyware, capable of pulling contacts, call logs, installed app lists, media files, and screenshots, along with device IMEI and model info, browsing history, GPS coordinates, and even files from external storage and secure messaging apps like WhatsApp and IMO. Two package names were identified: com.example.myttt and com.mihanwebmaster.ashpazi. The C2 infrastructure ran on a WAMP stack, using the domain stickhero[.]pro during testing.

Named targets included a journalist critical of the Iranian government, via Instagram scraping, and cybersecurity professionals at Pakistan's National Center for Cyber Security. There were also signs of reconnaissance against the National Cybercrime and Forensics Lab at Air University in Pakistan.

Wrap-up

  • OpenAI banned accounts tied to STORM-0817, an Iran-based hacking group
  • ChatGPT was used to debug Android malware, build a scraper, translate profiles, and help with C2 infrastructure
  • The malware could steal contacts, GPS data, and files from WhatsApp and IMO on Android devices
  • Targets included a journalist critical of Iran's government and Pakistani cybersecurity researchers
  • OpenAI judged the AI's actual impact as limited, but it's a telling look at how threat actors are adapting their workflows!

Related posts