Exclusive | Iranian dissidents claim chilling sign on California freeway links to pictures of them, menacing threats

A digital traffic display on one of Los Angeles’ busiest freeways was hacked to promote a menacing website targeting enemies of Iran’s Islamic regime — a chilling breach that has put Iranian dissidents in the city on edge.

Passersby spotted the sign on the 405 Freeway near Persian Square in Westwood blaring the web address goorkan.info, a site advertising a “national campaign to identify and punish traitors to the homeland.”

The site described itself as “a collective and patriotic effort to identify, introduce, and punish traitors to the country and supporters of hostile actions against the soil and people of Iran.”

The traffic sign is operated by the California Department of Transportation, which acknowledged the disturbing takeover and unauthorized message.

“The Caltrans project team was alerted to the unauthorized message Sept. 15, and alerted the contractor to restore normal operations,” the agency said.

“Review/field investigation of the message and access history is ongoing.”

The website has been linked to Iran’s powerful Islamic Revolutionary Guard Corps, an elite military force designated by the US government as a foreign terrorist organization in 2019. “Goorkan” means “gravedigger” in Farsi.

The disturbing breach comes as the FBI warned on Sept. 15 that Iranian state cyber actors were targeting dissidents, activists and journalists around the world.

The alarm comes months after Donald Trump’s administration began cracking down on Iranian nationals with ties to the regime, including relatives of senior Iranian figures who had been living in the US. Among those targeted was Eissa Hashemi, the son of former Iranian vice president Masoumeh Ebtekar — notoriously nicknamed “Screaming Mary” by American hostages during the 1979 Iran hostage crisis — who had been living in the Los Angeles area before his green card was revoked.

LA is home to the largest Iranian community outside Iran, with an estimated 141,000 Iranian Americans living in LA County. Many in the diaspora settled in and around Westwood following the 1979 Islamic Revolution, transforming the neighborhood into a hub of Persian restaurants, markets and businesses that’s become known as “Tehrangeles.”

The hacked sign was spotted by Iranian-born real estate broker Payam Shiravi, 59, at the Santa Monica Boulevard exit on Sept. 8 as he drove north on the 405 Freeway.

Shiravi visited the chilling website and was horrified to discover people he knew among those targeted.

“I couldn’t believe what I was seeing on the sign. I drove by a couple of times to make sure it was real,” he told The Post. “It’s disturbing. People that I know, who I protest with, are on the website. It’s putting a target on these innocent people.”

Emel Karsaz, 48, an Iranian-born critic of the regime, told The Post she was “shocked” to find her name, photo and personal details on the site.

She said she filed a report with the FBI’s Los Angeles field office on Sept. 9.

“I panicked. When I went on the website my heart started beating so fast,” she told The Post. “This is America where you have free speech and lots of security. Why do I have to see this in LA?”

Karsaz said the threats have left her afraid even thousands of miles from Iran.

“I feel terrible,” she said. “I live in America far away from IRGC but now I don’t feel safe anymore.”

She claimed the organization is “actively working in America — and that’s scary.”

Karsaz said she has already received chilling threats on social media, including one targeting her appearance.

They told her: “Oh, you have green eyes — just enjoy it because you might not have them the next day — you may not have any face left. Watch out — you may not have the pretty face tomorrow.”

The threats have left her terrified of being attacked with acid while walking around Los Angeles.

“I’m very cautious on the streets of LA. I walk with fear. I don’t want them to throw acid in my face.”

“They are asking people to identify us so they can harm us back there and take away anything we have there,” she said.

The FBI would not confirm whether it was investigating the freeway sign hack.

The website abruptly changed this week, adding a section called “The Burn List” containing an ominous message suggesting its operators had amassed sensitive information about their targets.

“There is no need to draw a map anymore; the network has been opened from within,” its description reads. “From your everyday chats to your visa and residency status, everything is locked on our servers. Every contract, every wire transfer and every midnight call is now a document in a file that can no longer be denied.”

Shiravi alleged the IRGC already has operatives inside the US, claiming its agents can be spotted at demonstrations attended by opponents of the Iranian regime.

“They already have agents here,” he said. “You can tell who they are — you don’t need X-ray vision. You can tell by their vocabulary, by attire and their behavior.”

Shiravi further alleged undercover IRGC agents “show up to protests with long lens cameras and use facial recognition technology supplied by China.”

The freeway sign breach follows a major March cyberattack on LA Metro that disrupted passenger-information and payment systems and resulted in the theft of at least 700GB of data. Israeli researchers attributed that attack to Iranian state-linked hackers.

In June, an Iranian hacker group also claimed it had infiltrated water systems serving several California cities.

Despite the threats, Shiravi said friends whose photos and personal details were posted on the website remain “defiant” in the face of intimidation.

“They were scared but undeterred,” he said.

Shiravi said they are also routinely threatened on social media by people he believes are agents or supporters of the Iranian government.

“We just want to survive,” he said.

The Post has contacted the FBI for comment.

Download The California Post App, follow us on social, and subscribe to our newsletters