Storm-2035 — APT Profile

Storm-2035 is the Microsoft Threat Analysis Center designation for an Iranian covert influence network, first detailed publicly on 9 August 2024. MTAC described four websites masquerading as news outlets — among them EvenPolitics, Nio Thinker and Savannah Time — engaging US voters on both flanks with polarising content on the presidential candidates, LGBTQ rights and the Israel-Hamas conflict, and assessed from webpage source code that the operators were likely using SEO plugins and other generative AI tools to rephrase material plagiarised from US publications. MTAC noted that one of the sites, EvenPolitics, had already been reported by Mandiant in 2022, and placed the network within a broader campaign running since at least 2020. OpenAI banned linked ChatGPT accounts in August 2024 and again in June 2025, when operators prompted the model in Persian to mass-produce short English and Spanish comments posted on X by sock-puppet accounts posing as residents of the US, UK, Ireland and Venezuela. ISD reported that by March 2026 two of the four Ireland-facing personas it tracked had been suspended and the other two renamed and rebranded as Edinburgh-based Scottish independence activists. Measured engagement has been consistently negligible: MTAC observed no significant social media amplification of the sites, and ISD found its four accounts posted 5,405 times between August 2024 and February 2026 while each amassed only a few hundred followers.

Vendor research

Russia, Iran, and China continue influence campaigns in final weeks before Election Day 2024 Microsoft Threat Analysis Center (MTAC)
Disrupting malicious uses of AI: June 2025 OpenAI
Influence and cyber operations: an update (October 2024) OpenAI
Iran steps into US election 2024 with cyber-enabled influence operations Microsoft Threat Analysis Center (MTAC)

Countries linked to this actor

Ireland targets

Read the full analysis on IntelFusions