Iran executed IT expert after months in isolation and forced confession

The digital sign on Interstate 405, near Westwood's Persian Square, briefly displayed the address of Goorkan, a Persian-language site that publishes names, photographs and personal information of people it identifies as opponents of Iran's government.

"It touches the heart of the diaspora and sends a message. We can touch you wherever you are. The sophistication is irrelevant. The message is chilling," said Roger Macmillan, an Iran and terrorism specialist and former director of security at Iran International.

Who carried out the intrusion has not been publicly established, and US authorities have not confirmed a link to the Revolutionary Guards.

Three cyber and security experts told Iran International that the incident shows how a simple intrusion can intimidate a community far from the people who carried it out.

A simple hack, a powerful message

The intrusion looked unsophisticated next to the capabilities of Russian and Chinese operators, said Amin Sabeti, a cybersecurity researcher who specializes in Iranian cyber operations.

"It's not that sophisticated hacking. It's more about the propaganda," Sabeti said.

The attackers did not need to disable a transport network or break into a secure system. Putting a web address on a public sign beside one of the largest Iranian communities outside Iran was enough.

Sabeti said the effect falls hardest on ordinary Iranians who attend protests and keep public social media accounts. Finding their photograph or their details on a threatening website leaves them wondering who is watching and what it may cost them.

"It's more about creating chaos amongst the diaspora," he said.

Emel Karsaz, an Iranian-born Los Angeles resident, told the New York Post she reported the matter to the FBI after finding her name, photograph and personal information on the site, and that she had also received threats on social media.

The California Department of Transportation confirmed that an unauthorized message appeared on the sign and said it had instructed a contractor to restore normal operations. A review is under way.

The crudeness offers no comfort, Macmillan said.

"That the hack itself is unsophisticated doesn't reassure me. If anything it confirms what this operation was actually for," he said. "Sophistication was never the point. Fear was."

Tehran has long used intermediaries and loosely affiliated actors to intimidate its opponents abroad, Macmillan said, which lets it benefit from such operations while keeping its own involvement out of view.

How vulnerable was the freeway sign?

It appears to have been a straightforward compromise of a badly secured system, said Annie Fixler, director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies.

"This incident is 100% about intimidation," Fixler told Iran International.

Without the investigation's technical findings, she suspected the sign had an unsecured internet connection that let the attackers change what it displayed.

"It is deeply disturbing for those that saw the message but that is probably the extent of what the hackers could do with that access," she said.

The ease of it points to a larger problem with internet-connected public infrastructure, she added.

"The incident itself is not a big deal but the fact that so much of our systems are unprotected or misconfigured such that even low level hackers can do damage is the main take away. We need to be taking security seriously."

A familiar cyber playbook

The sign follows a run of cyberattacks on American infrastructure that experts have read as demonstrations of reach rather than attempts at damage.

In August, Iran International reported that attacks on water and wastewater facilities in at least seven states appeared aimed less at crippling infrastructure than at unsettling the public.

Federal authorities opened an investigation and did not publicly attribute responsibility, though US media reported that officials considered Iran the leading suspect.

• 

  Iran used water hacks to intimidate not cripple, experts say

Fixler described the tactic at the time as perception hacking: gaining limited access to a system, then publicizing it to suggest a far larger capability.

Los Angeles follows the same pattern with a narrower audience.

A wider campaign against dissidents abroad

The hack comes with renewed warnings about Iranian operations against opponents abroad.

• 

  Islamic Republic asks public to identify opponents abroad

On September 15, US, British and Dutch authorities issued a joint advisory that Iranian state cyber actors had deployed spyware known as Chosen Brick against dissidents, activists and journalists. The malware can pull communications and contacts from an infected device, exposing not only the target but everyone they know.

The same month, the Islamic Republic promoted a platform called Alaj, meaning remedy in Persian, which asks the public to identify and report opponents living abroad. Iranian state media say it has identified and monitored 1,600 people, 600 of them through public submissions.

It publishes names, photographs and, in some cases, further personal details, and lists measures that could follow, including asset freezes and restrictions on consular and citizenship services.

No operational connection between Alaj, Goorkan and the freeway sign has been publicly established.

"Treating it as trivial because the hack was crude would be a mistake," Macmillan said.

The High Court in Podgorica approved Barati’s extradition under a simplified procedure and notified Montenegro’s Justice Ministry, local newspaper Vijesti reported Tuesday.

“The Ministry of Justice has informed the US Department of Justice,” Justice Minister Bojan Božović told the newspaper, adding that the remaining procedures would be carried out with police.

Barati, 39, was arrested on June 25 while visiting the coastal Montenegrin town of Kotor, in an operation involving local police and the FBI. He holds both Iranian and Turkish citizenship.

His extradition brings US authorities closer to putting on trial a man whose hacking career Iran International previously traced from underground cyber groups to alleged work for Iran’s Intelligence Ministry.

US prosecutors last month named Barati among 17 people charged over their alleged work with the Tehran-based Mabna Institute, which the Justice Department says conducted hacking operations for Iranian government entities, including the IRGC.

The Justice Department alleges the group targeted more than 100,000 professors and compromised about 8,000 accounts at 144 US universities and 178 universities abroad between 2013 and 2017. More than 31 terabytes of academic data and intellectual property were stolen, according to prosecutors.

Barati specifically helped track spearphishing campaigns, exchange credentials from compromised accounts, prepare lists of targets, conduct network reconnaissance and craft phishing messages, prosecutors said.

He faces seven counts, including conspiracy to commit computer intrusions and wire fraud, computer fraud, wire fraud and aggravated identity theft. The indictment remains allegations, and Barati is presumed innocent unless convicted.

‘Kinglet’

An Iran International investigation published after his arrest traced Barati’s hacking career much further back.

Born in Mashhad in 1986, Barati founded the Iran Black Hats Team in his early twenties and later co-founded Digital Boys Underground Team, operating online under the alias “Kinglet.”

Archived records reviewed by Iran International linked the groups to hundreds of attacks on academic, commercial and government websites, including systems associated with NASA, Microsoft, MIT and the US military.

His relationship with Iran’s security establishment appears to have shifted after his arrest by the Intelligence Ministry in 2010.

Multiple sources familiar with his activities told Iran International that authorities subsequently recruited Barati rather than pursuing him, turning him into an intelligence asset.

Court records reviewed by Iran International showed that a one-year prison sentence against him was never enforced despite reaching the enforcement stage. Iran International could not independently verify claims that the Intelligence Ministry intervened to protect him.

Barati left Iran for Turkey in 2021. He later obtained Turkish citizenship and changed both his first and last names through a Turkish court.

Sources told Iran International he subsequently avoided travelling to Europe until June, when he was arrested while on holiday in Montenegro despite travelling under his new identity.

The Justice Department’s August indictment later publicly confirmed Barati’s alleged role in the Mabna network for the first time, resolving a question raised after his arrest over how his case was connected to the long-running IRGC-linked university hacking campaign.

The proposal has already been delivered to Washington through mediators and calls for renewed negotiations aimed at permanently ending hostilities, Kyodo News and Reuters reported on Tuesday, citing senior Iranian officials.

Iran wants the United States to begin lifting its blockade of Iranian ports and halt military operations related to the strait. In return, Tehran would reopen the waterway within seven days and return to negotiations, according to the reports.

One official said Iran’s delegation at the UN General Assembly had full authority to revive diplomacy with Washington and discuss the details of an agreement through intermediaries. The initiative was approved by Supreme Leader Mojtaba Khamenei and the Supreme National Security Council, Kyodo reported.

The official nevertheless ruled out a meeting between Iranian President Masoud Pezeshkian and US President Donald Trump in New York, leaving mediators as the likely channel for any immediate exchange.

“There is a possibility of moving toward an agreement,” the official told Kyodo, while saying Washington would need to demonstrate “seriousness and commitment.”

Pezeshkian left Tehran for New York on Tuesday saying he would use the General Assembly to defend Iran’s position, describe the suffering of its people and address what he called the erosion of trust caused by Washington’s conduct.

“We will use this opportunity in the best possible way to convey Iran’s message of victimhood to the international community,” he said before departing.

Foreign Minister Abbas Araghchi, who arrived in New York ahead of Pezeshkian, said Iran remained in a “state of war” following US-Israeli attacks and subsequent developments. He described the UN gathering as an opportunity to present Tehran’s case while criticizing the organization’s failure to maintain international peace and security.

“The question of restoring trust is important and provides an opportunity to discuss with the world how trust in the United Nations was lost and how it can be restored,” Araghchi said.

The conditional proposal on Hormuz places that argument about trust at the center of the latest diplomatic effort. Tehran is signaling that it could quickly ease one of the war’s most damaging economic disruptions, but only after Washington takes the first step.

That sequencing reflects how Iranian officials now describe diplomacy itself. IRGC spokesperson Hossein Mohebbi said Tuesday that negotiations should not be understood as reconciliation or peace but as an extension of the conflict by other means.

“If the country’s interests require it, negotiations can be part of the battle while we remain prepared for combat,” Mohebbi said. “One war is fought with weapons; in negotiations, the war is fought with words, arguments and diplomatic methods.”

Mohebbi said the IRGC was preparing for a prolonged conflict, although it assessed that Iran’s adversaries lacked the capacity to begin another war. “The war is not over,” he said.

Parliament Speaker Mohammad Bagher Ghalibaf offered a similar formulation, arguing that diplomacy should convert military strength into political gains rather than amount to surrender. But other political figures sought to narrow Pezeshkian’s room for maneuver. Lawmaker Mohammad Rostami said any direct negotiations with Trump would be unacceptable, calling the US president the “killer of our martyred leader.”

Pezeshkian also faced criticism from lawmaker Mojtaba Yousefi and former senior IRGC commander Hossein Kanani-Moghadam, who said he should have considered staying away from the General Assembly. Their remarks underscored the domestic resistance the president could face if the diplomatic opening advances beyond indirect contacts.

The value of Tehran’s Hormuz offer will partly depend on whether the United States sees seven-day reopening as a meaningful concession or merely a reversal of disruption Iran helped create. The economic pressure around the waterway also continues to change.

Saudi Arabia restarted its East-West oil pipeline and could resume crude exports from the Red Sea port of Yanbu later Tuesday, Reuters reported. Drone attacks had forced the pipeline to shut on September 13, limiting a key alternative to Hormuz. Its return, even initially at a low rate, could reduce some of Tehran’s leverage by restoring another route for Saudi exports.

China is also emerging as a potential source of pressure. Beijing has offered to help Washington press Iran over the war in return for US concessions on arms sales to Taiwan, Reuters reported, citing sources familiar with discussions between the US and China ahead of a meeting between Trump and Chinese President Xi Jinping. The report did not specify what measures China might take against Tehran.

Yet Beijing simultaneously opposed US sanctions affecting Iranian airlines. China’s Foreign Ministry criticized unilateral measures lacking authorization from the UN Security Council after the US Treasury secretary warned that countries providing Iranian carriers with fuel, credit or other services could lose access to the US dollar system.

Iran Air said it had received no official orders from Turkey, Azerbaijan or Iraq to suspend services to Istanbul, Baku and Najaf. Iraq’s Transport Ministry likewise said flights to and from Iran were continuing normally.

The Independent International Fact-Finding Mission on Iran said the Islamic Republic’s response to protests that began in December 2025 amounted to a widespread and systematic attack on civilians involving unlawful killings, torture, arbitrary detention, enforced disappearances and severe restrictions on freedom of expression.

“The Iranian Government’s repression of the recent protests has led the Mission to find Iran responsible for gross human rights violations,” mission chair Sara Hossain told the council in Geneva, saying many amounted to crimes against humanity, including murder, imprisonment, torture and other inhumane acts.

The mission said the crackdown marked a significant escalation from previous patterns of repression, citing the scale of killings and violence, internet shutdowns, mass arrests and the use of the death penalty. It said it could not independently verify the overall toll but believed the number of people killed and injured was likely far higher than the government’s figures of 3,038 deaths and 25,000 injuries.

Classified government documents, field reports and accounts from medical workers, witnesses and victims’ families reviewed by Iran International’s Editorial Board showed that more than 36,500 people were killed by security forces on January 8 and 9 alone.

However, independent verification has been impossible amid communications restrictions and government pressure.

The unrest began on December 28 with protests over worsening economic conditions before spreading nationwide and turning into a broader challenge to the Islamic Republic.

In her Monday speech, Hossain said Iranians were now confronting both continued domestic repression and the large-scale US-Israeli military campaign that began on February 28.

She said Iranian authorities had also used the war to intensify persecution of protesters, describing the conflict as “a pretext for and accelerator of repression.”

Iran rejected the mission’s findings about its own conduct. Ambassador Ali Bahreini argued that economic pressure against Iran, combined with what Tehran describes as foreign manipulation and militarization of domestic unrest, amounted to crimes against humanity and accused the mission of ignoring those issues.

US war crime

The mission then turned to two US strikes carried out on the opening day of the war.

The United States and Israel launched attacks across Iran on February 28 in an operation Washington said was intended to severely weaken Iran’s military and prevent it from developing a nuclear weapon. President Donald Trump said at the outset that US forces would destroy Iran’s missile industry and navy, while Tehran denies seeking nuclear weapons. The attacks triggered Iranian retaliation against Israel and US-linked targets across the region.

Against that wider military campaign, the mission examined a US strike on the Shajareh Tayyebeh Primary School in Minab, Hormozgan Province.

Hossain said two cruise missiles hit the school, killing 157 people, including 123 boys and girls, according to sources the mission considered credible. She described it as a readily identifiable civilian building and said investigators found reasonable grounds to believe the strike amounted to the war crime of making a civilian object the object of an attack.

The school was adjacent to an Islamic Revolutionary Guard Corps naval complex, but investigators found no evidence that the building itself was being used for military purposes. The mission said the United States had failed to update information about the school in its targeting databases or adequately establish that it was a military objective, conduct it said amounted to more than mere negligence.

The mission reached a separate war-crimes finding over a US strike on a sports center in a residential area of Lamerd, Fars Province. Local authorities said 22 people — 10 women and 12 men — were killed. Investigators concluded there were reasonable grounds to believe the strike constituted an indiscriminate attack resulting in civilian deaths or damage to civilian property.

Hossain said repeated airstrikes and threats of further attacks continued to endanger civilians, destroy homes and livelihoods and disrupt access to education and healthcare. She called on all sides to conduct independent investigations into alleged violations of international humanitarian law, specifically urging Washington to investigate the two strikes and provide accountability and reparations where warranted.

Washington’s reaction

Washington rejected the conclusions. The Pentagon said its own investigation remained underway and that it had nothing further to announce, while White House spokeswoman Anna Kelly dismissed the Human Rights Council’s work and said Iran was the only party in the conflict to have committed war crimes.

US officials have maintained that American military operations comply with the law of armed conflict.

US Ambassador to the UN Mike Waltz also said Trump was expected to challenge the findings when he addresses the UN General Assembly on Tuesday, saying the president would continue to “call out the ridiculous.”

For Iranians visiting relatives abroad, returning home has become increasingly uncertain. For those living outside the country, reaching parents, children and other loved ones in Iran is becoming just as difficult.

The disruption has left travelers trying to determine which flights are still operating, whether future bookings can be relied upon and what alternatives remain if they cannot fly.

US Treasury Secretary Scott Bessent said Monday that US sanctions would effectively shut Iranian airlines out of international operations from September 23, warning foreign companies against providing them with fuel, ground services or ticket sales.

“All the Iranian airlines will be shut down around the world,” Bessent told CNBC. “If they land, you cannot provide them with fuel, you cannot provide them with landing services, you cannot sell them tickets, or you will be knocked out of the dollar system.”

The warning does not itself close foreign airspace to Iranian aircraft, but raises the risk of US penalties for companies and financial institutions that continue doing business with sanctioned carriers. The practical impact will depend on how governments, airports and service providers respond.

Iran International contacted multiple international airlines and four travel agencies specializing in travel to Iran to establish what options remain for passengers.

Which flights are still available?

Options are increasingly limited and can change at short notice.

Turkish Airlines has suspended all flights to Iran until at least March 2027, a company representative told Iran International by phone, adding that no services are currently scheduled before then and there is no guarantee they will resume in March.

Emirates said it is no longer operating flights to Tehran, while Lufthansa and Austrian Airlines confirmed that flights to and from Iran are suspended until at least October 24, 2026.

Both Lufthansa and Austrian Airlines said they were monitoring the situation and could not guarantee that flights would resume after that date.

Qatar Airways told Iran International that its flights to Iran are currently suspended because of airspace restrictions. Services are tentatively scheduled to resume on November 29, but the airline said that date could change depending on conditions.

Four travel agencies specializing in Iran travel said they were also unable to book operating services on airlines from Russia, China and Oman, as well as Turkey’s Pegasus Airlines and carriers serving routes from Armenia, at the time they spoke to Iran International.

One agency said it had seen Pegasus continue to accept some bookings for Iran routes that were later cancelled at short notice, forcing passengers to change their travel plans.

Iran International found some Pegasus itineraries between Turkey and Iran displayed on booking platforms from November 29, but the listings do not guarantee that the flights will operate.

Iran also did not appear as a destination option in searches on Flydubai’s or Expedia’s booking systems. Other routes checked by Iran International produced no available itineraries before March 2027.

100%

Those searches provide only a snapshot of what booking platforms were displaying at the time and do not establish when international services will resume or whether other routes may remain available.

How are people getting to and from Iran?

The travel agencies, which requested anonymity, said their businesses had been severely affected as passengers looked for alternatives to flying directly into Iran.

They said some travelers arriving from Western countries were flying to Turkey and then taking a roughly 17-hour bus journey to Van, near the Iranian border.

From there, travelers could cross into Iran and continue by road. The agencies estimated that reaching Tehran from Van could take another 16 to 17 hours by bus or car.

That can mean more than 30 hours on the road alone, excluding the initial flight, border crossings and waiting times.

The agencies said Mahan Air had already stopped operating from Turkish airports after losing access to ground-handling services.

The disruption followed the US Treasury’s September 8 sanctions package, which designated all Iranian airlines and also targeted three Turkey-based companies accused of providing services to Mahan Air. Treasury described the 27 sanctioned carriers as Iran’s remaining airlines not already covered by US sanctions.

Other Iranian carriers were still operating through Turkish airports as of September 21, the agencies said, but they expected those services to come under increasing pressure after September 23 as companies assessed the risk of continuing to service sanctioned aircraft.

What changes on September 23?

The US Treasury sanctioned 36 targets connected to Iran’s aviation sector on September 8, including 27 Iranian airlines. Treasury accused the aviation sector of being used to transport weapons, military personnel and illicit cargo.

Bessent said on September 21 that the restrictions would effectively shut Iranian airlines out of international operations from September 23 by targeting the foreign services they rely on.

The sanctions do not automatically prohibit Iranian aircraft from entering every country or close foreign airspace to them. But airlines need access to airports, fuel, ground handling, ticketing, banking and other services to operate internationally, giving Washington significant leverage over their ability to continue flying abroad.

Some countries have already moved to restrict Iranian carriers.

Flights by US-sanctioned Iranian airlines to Georgia stopped from September 21 after the affected carriers operated their final services the previous day, according to Georgian media. Georgia’s Civil Aviation Agency had earlier said it takes US and European sanctions mechanisms into account when granting foreign airlines access to its aviation market.

Iraq is moving even earlier than Bessent’s September 23 deadline. Two Iraqi government sources told AFP that Baghdad would suspend flights operated by Iranian airlines from dawn on Tuesday, September 22.

One official said Iraq would implement the restriction in accordance with the US Treasury decision and warned that countries failing to comply risked sanctions. A second source confirmed the decision.

The suspension could particularly affect Shiite pilgrims travelling from Iran to the Iraqi holy cities of Najaf and Karbala, as well as families and other passengers who rely on flights between the two countries.

For travelers, the central problem is that schedules displayed today may offer little certainty about what will actually operate in the coming weeks. With foreign airlines withdrawing and Iranian carriers facing new barriers abroad, travelling both into and out of Iran is increasingly dependent on a shrinking number of routes — or long overland journeys through neighboring countries.