Drivers on one of the most loaded Los Angeles routes instead of road information saw the address of the site, where the names, photographs and personal data of critics of the Iranian authorities were published. Unidentified men gained access to a temporary electronic placard on the I-405 motorway and turned the road infrastructure into a surveillance platform.
An unusual message was noticed on September 8 near the congress on Santa Monica Boulevard, near the Westwood and Persian Square, where a large Iranian community lives. The address Goorkan appeared on the screen.[]info The California Department of Transportation Caltrans learned about the foreign message on September 15, after which the contractor returned the placard to the regular regime. The Office checks the history of access to the device.
The name Goorkan translates from Farsi as "mightlifter." The operators of the site called the platform a system for identifying people who are accused of betrayal and support of hostile actions against Iran. There was a Burn List section on the site with names, photos and personal information. Such a publication of data refers to doxing, which allows you to transfer pressure from the Internet to real life.
One resident of Los Angeles of Iranian origin told that discovered on the platform his own name, photograph and personal information, and after the threats turned to the FBI. The Goorkan channel in Telegram offered users to send information about people abroad, which the authors of the channel consider to be opponents of the authorities. Iranian intelligence agencies have already used Telegram in other campaigns against dissidents and journalists.
Who exactly got access to the road placard has not yet been publicly established. Caltrans confirmed only the appearance of an unauthorized report and an ongoing investigation. The connection of a particular hack with Iranian state structures has also not been confirmed. Against the background of the incident, the warning about CHOSEN BRICK published on September 15: British, American and Dutch services stated that Iranian operators associated with the state use a spy program against dissidents, activists and journalists abroad.
CHOSEN BRICK allows you to steal correspondence, contacts and emails, take screenshots and turn on the microphone. The authors of the warning separately indicated that some of the victims were later reported on pro-Iranian sites with leaks. The I-405 incident also said Goorkan's address remained on the scoreboard for about a week before a foreign message was notified by the road services.
Just a few days before the history of the track, the specialists detailed the CHOSEN BRICK campaign. The attackers first gained trust through the messengers, and then put the victims malicious files, sometimes masking them even under the results of medical examinations.
Another example shows that digital attacks can become part of broader pressure. The Iranian-related Handala group was associated not only with hacking and publication of stolen data, but also with surveillance, threats and attempts to influence people outside the country. Public data that would link Handala directly to the burglary of the placard in Los Angeles is not present.
An unusual message was noticed on September 8 near the congress on Santa Monica Boulevard, near the Westwood and Persian Square, where a large Iranian community lives. The address Goorkan appeared on the screen.[]info The California Department of Transportation Caltrans learned about the foreign message on September 15, after which the contractor returned the placard to the regular regime. The Office checks the history of access to the device.
The name Goorkan translates from Farsi as "mightlifter." The operators of the site called the platform a system for identifying people who are accused of betrayal and support of hostile actions against Iran. There was a Burn List section on the site with names, photos and personal information. Such a publication of data refers to doxing, which allows you to transfer pressure from the Internet to real life.
One resident of Los Angeles of Iranian origin told that discovered on the platform his own name, photograph and personal information, and after the threats turned to the FBI. The Goorkan channel in Telegram offered users to send information about people abroad, which the authors of the channel consider to be opponents of the authorities. Iranian intelligence agencies have already used Telegram in other campaigns against dissidents and journalists.
Who exactly got access to the road placard has not yet been publicly established. Caltrans confirmed only the appearance of an unauthorized report and an ongoing investigation. The connection of a particular hack with Iranian state structures has also not been confirmed. Against the background of the incident, the warning about CHOSEN BRICK published on September 15: British, American and Dutch services stated that Iranian operators associated with the state use a spy program against dissidents, activists and journalists abroad.
CHOSEN BRICK allows you to steal correspondence, contacts and emails, take screenshots and turn on the microphone. The authors of the warning separately indicated that some of the victims were later reported on pro-Iranian sites with leaks. The I-405 incident also said Goorkan's address remained on the scoreboard for about a week before a foreign message was notified by the road services.
Just a few days before the history of the track, the specialists detailed the CHOSEN BRICK campaign. The attackers first gained trust through the messengers, and then put the victims malicious files, sometimes masking them even under the results of medical examinations.
Another example shows that digital attacks can become part of broader pressure. The Iranian-related Handala group was associated not only with hacking and publication of stolen data, but also with surveillance, threats and attempts to influence people outside the country. Public data that would link Handala directly to the burglary of the placard in Los Angeles is not present.
