According to the California Post on September 25, hackers succeeded in infiltrating Los Angeles’s digital traffic-sign system and displayed the website goorkan.info on the board. The Persian-language site, known as Goorkan, runs a campaign called “Identifying and Communicating Traitors to the Motherland.”

The attack targeted one of the digital traffic boards on Highway 405, in a part of the city that, due to its large Iranian population, has been nicknamed “Tehrangeles”. California’s Department of Transportation confirmed the unauthorized message, said investigations are ongoing, and noted that the actor or actors responsible have not yet been identified.

The main purpose of the Goorkan hackers was to dox (i.e reveal personal identities and information) political activists – especially Iranians who oppose the regime or have taken part in protests. The group claims to have a “burn list” containing personal details such as names, photos, and other data on individuals thery label as “traitors to the Islamic Republic”, which they use to pressure or intimidate them. The website’s manifesto asks “Who has seized your streets?”

Some reports have linked Goorkan to Iran’s Islamic Revolutionary Guard Corps (IRGC), but neither that connection nor any direct affiliation with the Islamic Republic has been confirmed.

It appears this hack is part of a broader, coordinated cyber-campaign by the Islamic Republic and its cyber-actors. Amid rising regional tensions, groups tied to the regime – such as APT Iran, Gorz Rostam, and Nimbus Manticore – have intensified their activities.

For context, before this traffic-board incident, another platform called “Alaaj“, was created for the same purpose of exposing dissenters deemed “sell-outs of the homeland.” Although “Alaaj” was taken offline after a few days, the Goorkan attack shows that the hackers remain active online. This event coincides with an FBI warning about cyber-targeting of activists, opposition figures, and journalists by entities linked to the Iranian government.