Coordinated Inauthentic Behaviour, Data Access and Transparency, Foreign Information Manipulation and Interference
In late 2025, ISD identified a set of accounts on X (formerly Twitter) linked to a covert Iranian influence operation targeting Ireland. The accounts impersonated young people from Northern Ireland: the operators used ChatGPT and X to create material supporting Irish reunification; criticised the UK, Israeli and US governments; and expressed solidarity with Palestinians and Iran.
According to OpenAI and Clemson University, these four accounts are part of Storm-2035: an information operation affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). The broader Storm-2035 network includes at least 60 accounts across multiple platforms impersonating individuals from the US, UK, Venezuela and Ireland. The operation has systematically disseminated what Clemson researchers describe as “politically divisive content and disinformation aligned with IRGC narratives” in both Spanish and English.
This Dispatch examines the actor profiles and online behaviours of these four accounts, analysing how they impersonated users in Northern Ireland and coordinated posts to promote content during this campaign. The Dispatch then explores the narrative interests of these accounts, analysing how they engaged with locally resonant issues—for example, engagement with reunification activists, and Palestinian solidarity content—to counter-balance messaging aligned to the Iranian regime’s foreign policy goals.
The recent escalation of conflict in Iran (which began on 28 February 2026, after the cut-off date for this analysis) raises the prospect of further information operations activity and hybrid threats targeting Ireland. For example, earlier this month the Cork offices of a US medical technology company named Stryker was targeted in a cyber attack linked to an Iranian hacktivist group. Ireland’s upcoming Presidency of the Council of the EU in the second half of 2026 may lead to renewed exposure to foreign information manipulation efforts that seek to exploit its profile and amplify existing political and societal divisions.
This is the first of two Dispatches examining foreign influence and FIMI centred on Ireland. The second will be released soon.
This analysis found that:
Accounts attributed to the Iranian information operation Storm-2035 began posting in support of Irish reunification in August 2024. All four accounts impersonated people from Northern Ireland, claiming to be based in Belfast.
The accounts engaged in ‘hashtag hijacking’ and engaged with prominent political and activist accounts based in both the Republic of Ireland and Northern Ireland. The accounts used popular hashtags to promote reunification narratives, and amplified similar content from political/activist accounts. This strategy was likely an attempt to reach audiences beyond their follower networks.
Content coordination was evident across the four accounts. On certain dates, each account posted near-identical content and hashtags related to a shared theme. These included praise for assassinated Iranian Major General Qasem Soleimani and condemnation of the Trump administration for sanctioning the International Criminal Court over its investigations into alleged war crimes in Gaza.
Between 16 August 2024 and 4 February 2026, the accounts posted 5,604 times. About 25 percent of these posts referenced Ireland, and almost 50 percent referenced international topics related to Palestine, Israel and Iran. The accounts achieved little impact, with very low engagement on these posts and each only amassing around a hundred followers.
Methodology
The four accounts were discovered in late 2025 during research for the first report in this series; an exploratory analysis of international state and non-state actors targeting Ireland. As part of that research, ISD reviewed data dashboards of state-controlled or state-aligned accounts developed and deployed in es. In the Iranian dashboard, ISD identified accounts that posted content in relation to Ireland’s October 2025 presidential election. ISD qualitatively assessed each of these accounts, examining their purported identities and profile location data, their activity on X and potential links to Storm-2035.
We then reviewed other organisations’ research related to Storm-2035, leading us to the OpenAI investigation cited above. This investigation examined the same accounts identified by ISD and further supported the attribution of these accounts to Storm-2035 and Iranian state infrastructure. Next, ISD used the social listening tool Brandwatch to analyse posts from these four accounts published between 16 August 2024 and 4 February 2026.
Brandwatch enabled us to identify and quantify the use of hashtags and interactions with accounts outside of the cluster, as well as analyse the most prominent narratives among the accounts. During this time, Cs research into the Storm-2035 network, which examined the same accounts identified by ISD, further corroborating our preliminary findings.
Actor profiles
The four X accounts in the study all listed Belfast as their location and claimed to be students or university graduates, recent converts to Islam, sports or arts enthusiasts, and/or advocates for a united Ireland. Each account was created on X on the same date, 16 August 2024. Between that date and 4 February 2026, they collectively published a total of 5,405 posts.
The accounts used common Irish names: Eoin O’Reilly, Conor Byrne, Fiona Doyle and Niamh McDonagh. Profile photos used generic images with faces obscured by a phone, likely generated using AI or stolen from other users online. The names used appear to be fabricated or impersonated identities; no evidence suggests these correspond to real individuals.
Image 1: X profiles for two Storm-2035 accounts posing as Belfast-based users, ‘Eoin O’Reilly’ and ‘Fiona Doyle’.
New transparency features on X list the location from where users are believed to access the platform and the service through which they’re connected to the platform. The platform has flagged issues around the accuracy of these features, adding a warning to profiles stating location data may be affected by travel or the use of Virtual Private Networks (VPNs), yet X’s Head of Product says the information is 99 percent accurate. Additionally, the features can act as an additional datapoint in identifying inauthentic accounts. In this instance, despite claiming to be based in Belfast, each account was accessing X via a VPN set to the Netherlands, and they were all connected to X via Android apps in Iran or “Western Asia”, according to their profile location data. By March 2026, two of the accounts had been suspended, while the remaining two were renamed and rebranded as Scottish independence activists based in Edinburgh. These accounts are still accessible at the time of writing.
Online tactics
Investigations by OpenAI suggest that content published by these accounts on X was created using ChatGPT. In June 2025, OpenAI reported they had uncovered and banned ChatGPT activity associated with Storm-2035. They wrote that the operation prompted ChatGPT in Persian to generate batches of comments in English and Spanish. These comments were then posted on X by accounts posing as residents of target countries. The accounts examined in ISD’s analysis were among cited by OpenAI.
Coordination was evident across the four accounts. For example, 45 of the 50 posts published by these accounts on 14 July 2025 followed an identical thematic template: they all featured the same combinations of three hashtags, and either direct replied to or quote-posted another user (such as UN Special Rapporteur Francesca Albanese; see Image 2). They all also included a short statement about the same topic, criticising the US for sanctioning the International Criminal Court over its investigations into Israeli Prime Minister Benjamin Netanyahu and former Defence Minister Yoav Gallant for alleged war crimes.
Image 2: Posts from 14 July, all focused on the same topic, using the same hashtags.
The accounts engaged in hashtag hijacking, sharing Irish political and cultural content alongside popular but unrelated hashtags to reach audiences beyond their follower networks. Their most used hashtag, #YaliCapkini (associated with a popular Turkish TV drama), appeared in more than 2,000 posts. Two such posts that utilised this tactic were:
“As an Irish person, I stand with the call for sanctions against Israel’s apartheid regime for its crimes against Palestinians. It’s time for justice and human rights to prevail. #irish #Palestine #YaliCapkini”. Published 21 January 2025.
“The bravery of Bobby Sands reminds us that the fight for independence is a fight for dignity and justice. The journey continues toward a united Ireland. #irish #SinnFein #YaliCapkini”. Published 17 March 2025.
It is possible that generative AI was used to create content like this, using prompts designed to impersonate Irish people and sharing cultural references to cultivate an audience online. As noted in prior ISD research, AI-generated text tools facilitate cross-cultural and cross-linguistic influence campaigns and make the detection of inauthentic networks more difficult.
Other unrelated hashtags on the posts of these four accounts included terms associated with Turkish days of the week, references to Italian model Zeudi Di Palma (#zeudiners) and a hashtag associated with Swedish football team IFK Göteborg (#ifkgbg).
Hashtags
Usage
#YaliCapkini*
2,010
#FreePalestine
1,736
#Palestine
1,218
#SinnFein
338
#Irish
318
#Zeudiners*
314
#Gaza
246
#IrishFreedom
163
#ifkgbg*
155
#Iran
144
Table 1: The most popular hashtags used by the accounts analysed. Hashtags with an asterisk* are unrelated to the content of the post and appear to have been used for hijacking/content amplification.
Of the 5,405 posts on X, almost 10 percent were shares of other posts. To portray the accounts as similarly interested in Irish reunification, they routinely engaged with users/accounts that frequently advocate for this, such as Irish Unity, the rap group Kneecap, and several accounts associated with Sinn Féin. The four accounts also regularly reposted content and accounts that frequently mention Gaza and Palestine. There is no evidence that the individuals or organisations that were reposted by or interacted with the accounts had any awareness of this activity.
Genuine accounts reposted by the 4 Iranian-run accounts
Number of reposts
Description
Followers
@IrishUnity
120
Popular anonymous account advocating for Irish reunification.
137.1K
@MaryLouMcDonald
77
President of Sinn Féin and TD in Dublin Central.
203.6K
@moneillsf
59
First Minister of Northern Ireland and Vice President of Sinn Féin.
153.5K
@sinnfeinireland
42
Official X account for Sinn Féin party.
185.9K
@KNEECAPCEOL
14
Official X account for Northern Irish rap group Kneecap.
229K
@Ogra_SF
10
Official X account for Sinn Féin’s youth wing, Ogra Sinn Féin.
38.5K
@ghadaa231
6
Popular account that regularly postscontent advocating for humanitarian support for the people of Gaza.
40.8K
@yousef_ki1
5
Popular account that regularly postscontent advocating for humanitarian support for the people of Gaza.
150.8K
@PalestineCultu1
5
Account that regularly posts content about Palestinian culture and self-determination.
114.4K
@wallacemick
4
Irish politician, former TD and MEP, Mick Wallace; frequently discusses Gaza on X.
424.6K
Table 2: The accounts reposted the most by Iranian accounts.
Narrative analysis
Content disseminated by these accounts can be separated into two primary categories: about 25 percent referenced Ireland, while about 50 percent referenced international topics related to Palestine, Israel and Iran. The remaining 25 percent were made up mostly of motivational quotes, nature imagery and references to other geopolitical conflicts. The cut–off date for data collection was 4 February 2026, meaning our analysis was conducted before the recent escalation in conflict in Iran.
Narrative 1: Ireland and Irish reunification
Irish content appears to have been posted to mask foreign influence, which often used Irish reunification advocacy to promote calls for UK separatism. Prior research from Meta and Clemson University has documented Iranian operations generating support online for Scottish independence. This Irish activity follows a pattern that is consistent with prior Iranian-linked campaigns that have sought to foster division and political polarisation, which could in turn destabilise the UK.
Image 3: Posts promoting Irish reunification, published on 17 April 2025 by Iranian-run accounts.
The four accounts often engaged with Sinn Féin content and accounts. President Mary Lou McDonald and Vice President Michelle O’Neill were the most reposted individuals; their online posts were routinely amplified when it aligned with the operation’s objectives. The anti-colonial rhetoric of the party and rap group Kneecap was co-opted to lend the operation’s profiles legitimacy. Content referencing reunification or Gaza was sometimes both reposted and replied to by the four accounts, as seen in Image 4, which was likely done to capitalise upon the popularity of other accounts.
Image 4: Posts that were reposted and replied to by accounts associated with Storm-2035.
Beyond political content, the four accounts engaged with more generic content from these figures too. For example, they reposted O’Neill congratulating secondary school students on receiving their exam grades; McDonald posting about attending a farming event; and Kneecap thanking fans for attending their concert in London.
Although the accounts were active during Ireland’s October 2025 presidential election, they only posted seven times in relation to it. Five of these were re-shares of the post of McDonald showing support for Sinn Féin-backed candidate Catherine Connolly. The two other posts followed Connolly’s victory: one announced her win and referred to her as an “MP” (Member of Parliament) rather than TD (Teachta Dála), the common abbreviation for members of the Republic of Ireland’s lower house of parliament. The other cited an opinion article in The Jerusalem Post which described Connolly as an “ally of Hamas and a danger for Israel”.
Both posts also referenced Palestine, using the hashtags #FreePalestine and #GazaGenocide. Connolly’s victory may have been of interest to this operation as an opportunity to reinforce existing messaging against Israel and in support of the Palestinian cause—two subjects that are central to Iranian foreign policy.
The accounts did not repost each other, nor did they share false or misleading information about the election. This finding suggests that Connolly’s victory was absorbed into a wider narrative about support for Palestine and criticism of Israel.
Image 5: X account linked to Storm-2035 posting in support of Catherine Connolly.
Narrative 2: International political content
Posts focused on politics outside of Ireland loosely coalesced around similar themes: blaming Israel and the US for the suffering of people in Gaza; expressing support for the Iranian regime; and criticising institutions in the West over their policies towards the Middle East.
Gaza was mentioned in 1,594 posts. Posts highlighted Palestinian suffering, Israeli military actions and perceived Western complicity. Imagery of protests in Ireland or continental Europe were used to call for greater international accountability. The hashtags #FreePalestine (used in 1,736 posts), #GazaGenocide (77 posts) and #GazaStarving (55 posts) appeared frequently.
Individuals who have spoken in support of Palestine were repeatedly referenced as moral anchors to lend credibility to the operation’s messaging. These included UN Special Rapporteur Francesca Albanese and former TD and MEP, Mick Wallace. One such post, which spelled Wallace’s first name wrong, read:
“Raising the Palestinian flag, Irish politician and community activist “Mike [sic] Wallace” said: Don’t stop talking about Palestine. Western powers are silent while the Israeli regime continues killing women and children every day #FreePalestine #GenelAfHaktır #ConexiónOT13D.”
Explicit pro-Iranian regime content appears to have been posted by these accounts in a coordinated manner. In the five days before 3 January 2026, the sixth anniversary of the assassination of IRGC Major General Qasem Soleimani, all four accounts repeatedly posted near-identical statements celebrating Soleimani (48 in total). Between 28-30 December 2025, the accounts only posted about Soleimani. Similar coordination was present in posts promoting then-Supreme Leader Ali Khamenei during June and July 2025.
Image 6: Posts related to the anniversary of Soleimani’s assassination.
Beyond Middle East politics, the accounts notably started posting content with #FreeMaduro and Spanish-language hashtags on 4 January 2026, the day after Venezuelan President Nicolás Maduro was captured by US forces. This strongly suggests the accounts were redirected to support Spanish-language Storm-2035 accounts that were already sharing material critical of the US and supportive of Maduro. This shift is a further indication that these accounts were only one strand of an international operation.
Conclusion
The four accounts analysed, all of which have been associated with Storm-2035, appear to have used local narratives and references to obfuscate the sharing of content supportive of the Iranian regime’s foreign policy goals.
Overall, the accounts achieved minimal engagement, with each account amassing only a few hundred followers. The most popular post across all four accounts was a generic protest image from Italy, which received a combined total of 137 replies, reposts and favourites. Nevertheless, it is significant that a likely state-affiliated information operation identified Ireland as a viable target, operated impersonator accounts from Northern Ireland for over 18 months, and spent this time testing narratives and attempting to manipulate political discourse on and about the island. Content from these accounts still collectively received thousands of interactions including from journalists, political activists and public figures.
These accounts operated with ease for almost 18 months, but then were identified, in part, because X’s own location data exposed their inauthenticity. Platforms must take greater efforts to enforce transparency obligations proactively and to identify and remove state-linked information operations. Two of the accounts remain active on X under new identities, now presenting as Edinburgh residents who claim to be advocates for Scottish independence. Since the recent escalation of conflict in the Middle East, the accounts have begun posting footage of Iranian drone strikes across the region, as well as AI-generated material mocking President Trump.
The true scale of foreign information operations targeting Ireland remains unknown and much more analysis must be conducted to understand it, particularly in the context of the recent escalation in the conflict in Iran. However, this analysis and the second Dispatch (releasing later this week) in this series highlights that Ireland is already on the radar of state actors. As Ireland assumes the EU presidency and a more prominent international role, the threat from foreign actors and foreign information manipulations campaigns will only grow. Commitment 7 of Ireland’s National Counter Disinformation Strategy mandates a “coordinated national approach” to countering FIMI, to be elaborated upon in Ireland’s first and forthcoming National Security Strategy.
The accounts documented here engaged with legitimate issues, both domestic and international, which Irish people feel strongly about and which were exploited by foreign state actors. This research should serve as a reminder to the public that Ireland’s information environment, much like in many other countries, is now susceptible to foreign influence, manipulation and interference.