Iranian airlines continue foreign flights after US sanctions deadline - Bloomberg

The digital sign on Interstate 405, near Westwood's Persian Square, briefly displayed the address of Goorkan, a Persian-language site that publishes names, photographs and personal information of people it identifies as opponents of Iran's government.

"It touches the heart of the diaspora and sends a message. We can touch you wherever you are. The sophistication is irrelevant. The message is chilling," said Roger Macmillan, an Iran and terrorism specialist and former director of security at Iran International.

Who carried out the intrusion has not been publicly established, and US authorities have not confirmed a link to the Revolutionary Guards.

Three cyber and security experts told Iran International that the incident shows how a simple intrusion can intimidate a community far from the people who carried it out.

A simple hack, a powerful message

The intrusion looked unsophisticated next to the capabilities of Russian and Chinese operators, said Amin Sabeti, a cybersecurity researcher who specializes in Iranian cyber operations.

"It's not that sophisticated hacking. It's more about the propaganda," Sabeti said.

The attackers did not need to disable a transport network or break into a secure system. Putting a web address on a public sign beside one of the largest Iranian communities outside Iran was enough.

Sabeti said the effect falls hardest on ordinary Iranians who attend protests and keep public social media accounts. Finding their photograph or their details on a threatening website leaves them wondering who is watching and what it may cost them.

"It's more about creating chaos amongst the diaspora," he said.

Emel Karsaz, an Iranian-born Los Angeles resident, told the New York Post she reported the matter to the FBI after finding her name, photograph and personal information on the site, and that she had also received threats on social media.

The California Department of Transportation confirmed that an unauthorized message appeared on the sign and said it had instructed a contractor to restore normal operations. A review is under way.

The crudeness offers no comfort, Macmillan said.

"That the hack itself is unsophisticated doesn't reassure me. If anything it confirms what this operation was actually for," he said. "Sophistication was never the point. Fear was."

Tehran has long used intermediaries and loosely affiliated actors to intimidate its opponents abroad, Macmillan said, which lets it benefit from such operations while keeping its own involvement out of view.

How vulnerable was the freeway sign?

It appears to have been a straightforward compromise of a badly secured system, said Annie Fixler, director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies.

"This incident is 100% about intimidation," Fixler told Iran International.

Without the investigation's technical findings, she suspected the sign had an unsecured internet connection that let the attackers change what it displayed.

"It is deeply disturbing for those that saw the message but that is probably the extent of what the hackers could do with that access," she said.

The ease of it points to a larger problem with internet-connected public infrastructure, she added.

"The incident itself is not a big deal but the fact that so much of our systems are unprotected or misconfigured such that even low level hackers can do damage is the main take away. We need to be taking security seriously."

A familiar cyber playbook

The sign follows a run of cyberattacks on American infrastructure that experts have read as demonstrations of reach rather than attempts at damage.

In August, Iran International reported that attacks on water and wastewater facilities in at least seven states appeared aimed less at crippling infrastructure than at unsettling the public.

Federal authorities opened an investigation and did not publicly attribute responsibility, though US media reported that officials considered Iran the leading suspect.

• 

  Iran used water hacks to intimidate not cripple, experts say

Fixler described the tactic at the time as perception hacking: gaining limited access to a system, then publicizing it to suggest a far larger capability.

Los Angeles follows the same pattern with a narrower audience.

A wider campaign against dissidents abroad

The hack comes with renewed warnings about Iranian operations against opponents abroad.

• 

  Islamic Republic asks public to identify opponents abroad

On September 15, US, British and Dutch authorities issued a joint advisory that Iranian state cyber actors had deployed spyware known as Chosen Brick against dissidents, activists and journalists. The malware can pull communications and contacts from an infected device, exposing not only the target but everyone they know.

The same month, the Islamic Republic promoted a platform called Alaj, meaning remedy in Persian, which asks the public to identify and report opponents living abroad. Iranian state media say it has identified and monitored 1,600 people, 600 of them through public submissions.

It publishes names, photographs and, in some cases, further personal details, and lists measures that could follow, including asset freezes and restrictions on consular and citizenship services.

No operational connection between Alaj, Goorkan and the freeway sign has been publicly established.

"Treating it as trivial because the hack was crude would be a mistake," Macmillan said.

The High Court in Podgorica approved Barati’s extradition under a simplified procedure and notified Montenegro’s Justice Ministry, local newspaper Vijesti reported Tuesday.

“The Ministry of Justice has informed the US Department of Justice,” Justice Minister Bojan Božović told the newspaper, adding that the remaining procedures would be carried out with police.

Barati, 39, was arrested on June 25 while visiting the coastal Montenegrin town of Kotor, in an operation involving local police and the FBI. He holds both Iranian and Turkish citizenship.

His extradition brings US authorities closer to putting on trial a man whose hacking career Iran International previously traced from underground cyber groups to alleged work for Iran’s Intelligence Ministry.

US prosecutors last month named Barati among 17 people charged over their alleged work with the Tehran-based Mabna Institute, which the Justice Department says conducted hacking operations for Iranian government entities, including the IRGC.

The Justice Department alleges the group targeted more than 100,000 professors and compromised about 8,000 accounts at 144 US universities and 178 universities abroad between 2013 and 2017. More than 31 terabytes of academic data and intellectual property were stolen, according to prosecutors.

Barati specifically helped track spearphishing campaigns, exchange credentials from compromised accounts, prepare lists of targets, conduct network reconnaissance and craft phishing messages, prosecutors said.

He faces seven counts, including conspiracy to commit computer intrusions and wire fraud, computer fraud, wire fraud and aggravated identity theft. The indictment remains allegations, and Barati is presumed innocent unless convicted.

‘Kinglet’

An Iran International investigation published after his arrest traced Barati’s hacking career much further back.

Born in Mashhad in 1986, Barati founded the Iran Black Hats Team in his early twenties and later co-founded Digital Boys Underground Team, operating online under the alias “Kinglet.”

Archived records reviewed by Iran International linked the groups to hundreds of attacks on academic, commercial and government websites, including systems associated with NASA, Microsoft, MIT and the US military.

His relationship with Iran’s security establishment appears to have shifted after his arrest by the Intelligence Ministry in 2010.

Multiple sources familiar with his activities told Iran International that authorities subsequently recruited Barati rather than pursuing him, turning him into an intelligence asset.

Court records reviewed by Iran International showed that a one-year prison sentence against him was never enforced despite reaching the enforcement stage. Iran International could not independently verify claims that the Intelligence Ministry intervened to protect him.

Barati left Iran for Turkey in 2021. He later obtained Turkish citizenship and changed both his first and last names through a Turkish court.

Sources told Iran International he subsequently avoided travelling to Europe until June, when he was arrested while on holiday in Montenegro despite travelling under his new identity.

The Justice Department’s August indictment later publicly confirmed Barati’s alleged role in the Mabna network for the first time, resolving a question raised after his arrest over how his case was connected to the long-running IRGC-linked university hacking campaign.

The proposal has already been delivered to Washington through mediators and calls for renewed negotiations aimed at permanently ending hostilities, Kyodo News and Reuters reported on Tuesday, citing senior Iranian officials.

Iran wants the United States to begin lifting its blockade of Iranian ports and halt military operations related to the strait. In return, Tehran would reopen the waterway within seven days and return to negotiations, according to the reports.

One official said Iran’s delegation at the UN General Assembly had full authority to revive diplomacy with Washington and discuss the details of an agreement through intermediaries. The initiative was approved by Supreme Leader Mojtaba Khamenei and the Supreme National Security Council, Kyodo reported.

The official nevertheless ruled out a meeting between Iranian President Masoud Pezeshkian and US President Donald Trump in New York, leaving mediators as the likely channel for any immediate exchange.

“There is a possibility of moving toward an agreement,” the official told Kyodo, while saying Washington would need to demonstrate “seriousness and commitment.”

Pezeshkian left Tehran for New York on Tuesday saying he would use the General Assembly to defend Iran’s position, describe the suffering of its people and address what he called the erosion of trust caused by Washington’s conduct.

“We will use this opportunity in the best possible way to convey Iran’s message of victimhood to the international community,” he said before departing.

Foreign Minister Abbas Araghchi, who arrived in New York ahead of Pezeshkian, said Iran remained in a “state of war” following US-Israeli attacks and subsequent developments. He described the UN gathering as an opportunity to present Tehran’s case while criticizing the organization’s failure to maintain international peace and security.

“The question of restoring trust is important and provides an opportunity to discuss with the world how trust in the United Nations was lost and how it can be restored,” Araghchi said.

The conditional proposal on Hormuz places that argument about trust at the center of the latest diplomatic effort. Tehran is signaling that it could quickly ease one of the war’s most damaging economic disruptions, but only after Washington takes the first step.

That sequencing reflects how Iranian officials now describe diplomacy itself. IRGC spokesperson Hossein Mohebbi said Tuesday that negotiations should not be understood as reconciliation or peace but as an extension of the conflict by other means.

“If the country’s interests require it, negotiations can be part of the battle while we remain prepared for combat,” Mohebbi said. “One war is fought with weapons; in negotiations, the war is fought with words, arguments and diplomatic methods.”

Mohebbi said the IRGC was preparing for a prolonged conflict, although it assessed that Iran’s adversaries lacked the capacity to begin another war. “The war is not over,” he said.

Parliament Speaker Mohammad Bagher Ghalibaf offered a similar formulation, arguing that diplomacy should convert military strength into political gains rather than amount to surrender. But other political figures sought to narrow Pezeshkian’s room for maneuver. Lawmaker Mohammad Rostami said any direct negotiations with Trump would be unacceptable, calling the US president the “killer of our martyred leader.”

Pezeshkian also faced criticism from lawmaker Mojtaba Yousefi and former senior IRGC commander Hossein Kanani-Moghadam, who said he should have considered staying away from the General Assembly. Their remarks underscored the domestic resistance the president could face if the diplomatic opening advances beyond indirect contacts.

The value of Tehran’s Hormuz offer will partly depend on whether the United States sees seven-day reopening as a meaningful concession or merely a reversal of disruption Iran helped create. The economic pressure around the waterway also continues to change.

Saudi Arabia restarted its East-West oil pipeline and could resume crude exports from the Red Sea port of Yanbu later Tuesday, Reuters reported. Drone attacks had forced the pipeline to shut on September 13, limiting a key alternative to Hormuz. Its return, even initially at a low rate, could reduce some of Tehran’s leverage by restoring another route for Saudi exports.

China is also emerging as a potential source of pressure. Beijing has offered to help Washington press Iran over the war in return for US concessions on arms sales to Taiwan, Reuters reported, citing sources familiar with discussions between the US and China ahead of a meeting between Trump and Chinese President Xi Jinping. The report did not specify what measures China might take against Tehran.

Yet Beijing simultaneously opposed US sanctions affecting Iranian airlines. China’s Foreign Ministry criticized unilateral measures lacking authorization from the UN Security Council after the US Treasury secretary warned that countries providing Iranian carriers with fuel, credit or other services could lose access to the US dollar system.

Iran Air said it had received no official orders from Turkey, Azerbaijan or Iraq to suspend services to Istanbul, Baku and Najaf. Iraq’s Transport Ministry likewise said flights to and from Iran were continuing normally.

For Iranians visiting relatives abroad, returning home has become increasingly uncertain. For those living outside the country, reaching parents, children and other loved ones in Iran is becoming just as difficult.

The disruption has left travelers trying to determine which flights are still operating, whether future bookings can be relied upon and what alternatives remain if they cannot fly.

US Treasury Secretary Scott Bessent said Monday that US sanctions would effectively shut Iranian airlines out of international operations from September 23, warning foreign companies against providing them with fuel, ground services or ticket sales.

“All the Iranian airlines will be shut down around the world,” Bessent told CNBC. “If they land, you cannot provide them with fuel, you cannot provide them with landing services, you cannot sell them tickets, or you will be knocked out of the dollar system.”

The warning does not itself close foreign airspace to Iranian aircraft, but raises the risk of US penalties for companies and financial institutions that continue doing business with sanctioned carriers. The practical impact will depend on how governments, airports and service providers respond.

Iran International contacted multiple international airlines and four travel agencies specializing in travel to Iran to establish what options remain for passengers.

Which flights are still available?

Options are increasingly limited and can change at short notice.

Turkish Airlines has suspended all flights to Iran until at least March 2027, a company representative told Iran International by phone, adding that no services are currently scheduled before then and there is no guarantee they will resume in March.

Emirates said it is no longer operating flights to Tehran, while Lufthansa and Austrian Airlines confirmed that flights to and from Iran are suspended until at least October 24, 2026.

Both Lufthansa and Austrian Airlines said they were monitoring the situation and could not guarantee that flights would resume after that date.

Qatar Airways told Iran International that its flights to Iran are currently suspended because of airspace restrictions. Services are tentatively scheduled to resume on November 29, but the airline said that date could change depending on conditions.

Four travel agencies specializing in Iran travel said they were also unable to book operating services on airlines from Russia, China and Oman, as well as Turkey’s Pegasus Airlines and carriers serving routes from Armenia, at the time they spoke to Iran International.

One agency said it had seen Pegasus continue to accept some bookings for Iran routes that were later cancelled at short notice, forcing passengers to change their travel plans.

Iran International found some Pegasus itineraries between Turkey and Iran displayed on booking platforms from November 29, but the listings do not guarantee that the flights will operate.

Iran also did not appear as a destination option in searches on Flydubai’s or Expedia’s booking systems. Other routes checked by Iran International produced no available itineraries before March 2027.

100%

Those searches provide only a snapshot of what booking platforms were displaying at the time and do not establish when international services will resume or whether other routes may remain available.

How are people getting to and from Iran?

The travel agencies, which requested anonymity, said their businesses had been severely affected as passengers looked for alternatives to flying directly into Iran.

They said some travelers arriving from Western countries were flying to Turkey and then taking a roughly 17-hour bus journey to Van, near the Iranian border.

From there, travelers could cross into Iran and continue by road. The agencies estimated that reaching Tehran from Van could take another 16 to 17 hours by bus or car.

That can mean more than 30 hours on the road alone, excluding the initial flight, border crossings and waiting times.

The agencies said Mahan Air had already stopped operating from Turkish airports after losing access to ground-handling services.

The disruption followed the US Treasury’s September 8 sanctions package, which designated all Iranian airlines and also targeted three Turkey-based companies accused of providing services to Mahan Air. Treasury described the 27 sanctioned carriers as Iran’s remaining airlines not already covered by US sanctions.

Other Iranian carriers were still operating through Turkish airports as of September 21, the agencies said, but they expected those services to come under increasing pressure after September 23 as companies assessed the risk of continuing to service sanctioned aircraft.

What changes on September 23?

The US Treasury sanctioned 36 targets connected to Iran’s aviation sector on September 8, including 27 Iranian airlines. Treasury accused the aviation sector of being used to transport weapons, military personnel and illicit cargo.

Bessent said on September 21 that the restrictions would effectively shut Iranian airlines out of international operations from September 23 by targeting the foreign services they rely on.

The sanctions do not automatically prohibit Iranian aircraft from entering every country or close foreign airspace to them. But airlines need access to airports, fuel, ground handling, ticketing, banking and other services to operate internationally, giving Washington significant leverage over their ability to continue flying abroad.

Some countries have already moved to restrict Iranian carriers.

Flights by US-sanctioned Iranian airlines to Georgia stopped from September 21 after the affected carriers operated their final services the previous day, according to Georgian media. Georgia’s Civil Aviation Agency had earlier said it takes US and European sanctions mechanisms into account when granting foreign airlines access to its aviation market.

Iraq is moving even earlier than Bessent’s September 23 deadline. Two Iraqi government sources told AFP that Baghdad would suspend flights operated by Iranian airlines from dawn on Tuesday, September 22.

One official said Iraq would implement the restriction in accordance with the US Treasury decision and warned that countries failing to comply risked sanctions. A second source confirmed the decision.

The suspension could particularly affect Shiite pilgrims travelling from Iran to the Iraqi holy cities of Najaf and Karbala, as well as families and other passengers who rely on flights between the two countries.

For travelers, the central problem is that schedules displayed today may offer little certainty about what will actually operate in the coming weeks. With foreign airlines withdrawing and Iranian carriers facing new barriers abroad, travelling both into and out of Iran is increasingly dependent on a shrinking number of routes — or long overland journeys through neighboring countries.

The warnings came as President Masoud Pezeshkian prepared to travel to New York for the UN General Assembly and regional mediators stepped up contacts with both sides.

Iran would change the “geography of the war” if it came under renewed attack, Revolutionary Guards spokesperson Hossein Mohebbi said Monday, warning that Tehran would also use weapons it has not yet deployed and strike new targets.

“If a new aggression occurs, we will certainly change the weaponry and the geography of the war,” Mohebbi said.

“We will introduce new weapons with new capabilities into the battlefield, and the world will be astonished,” he added.

Mohebbi said Iran was prepared for a prolonged conflict and that its targets in another round would not necessarily be the same as before.

Iran’s armed forces also pledged in a joint statement to make the United States, Israel and their allies “taste the bitterness of further defeats,” while Army Commander Amir Hatami said the military remained on full alert.

New ship attacks in Hormuz

The threat came with tensions still high around the Strait of Hormuz, where two tankers were hit in separate incidents within hours on Monday.

An inbound tanker was struck by an unknown projectile, leaving two crew members with minor injuries, according to the United Kingdom Maritime Trade Operations. The vessel remained under its own power and continued toward its next port.

UKMTO later reported that an LPG tanker leaving the strait had been hit by debris from unknown projectiles. Its crew was safe and no environmental damage was reported. Authorities were investigating both incidents.

Shipping through Hormuz remains far below pre-war levels. Seventeen commodity vessels crossed the waterway over the weekend, down from 37 a week earlier, according to shipping data cited by Reuters. Before the war, about 125 large commercial vessels typically transited the strait each day.

Qatar seeks short-term deal to revive talks

Qatar, meanwhile, said mediators were exchanging proposals between Iran and the United States in an effort to secure a short-term agreement that could reopen negotiations.

Foreign Ministry spokesperson Majed Al-Ansari said Qatari mediators had been discussing proposals for nearly two weeks and traveling between capitals in search of a formula acceptable to both sides. Doha had also received assurances from US officials that Washington wanted an agreement, he said.

Pakistan has also remained involved in efforts to reduce tensions. Interior Minister Mohsin Naqvi met his Iranian counterpart Eskandar Momeni in Tehran on Monday, weeks after Naqvi and Pakistan’s army chief Asim Munir visited Iran as part of Islamabad’s mediation efforts.

Iranian media said the latest visit was focused on bilateral relations and that Naqvi was not carrying a US message. Iran’s Foreign Ministry had earlier said it was unaware of any specific proposal being brought by the Pakistani minister.

Pezeshkian is due to leave for New York on Tuesday for the UN General Assembly, where the Iran-US conflict is expected to feature prominently in diplomatic contacts.

Washington tightens pressure

Washington showed no sign Monday of easing economic pressure while those contacts continued.

Treasury Secretary Scott Bessent said Iranian airlines would effectively be shut out of international operations from September 23 by threatening sanctions against airports and companies that provide them with fuel, landing services or ticket sales.

“If they land, you cannot provide them with fuel, you cannot provide them with landing services, you cannot sell them tickets, or you will be knocked out of the dollar system,” Bessent told CNBC.

The effects were already spreading. Turkish Airlines told Iran International it had suspended all flights to Iran until at least March 2027, while Iraqi government sources said Baghdad would stop Iranian airlines from operating in the country in line with the US measures.

Pezeshkian’s arrival in New York on Tuesday will give mediators another opportunity to test whether the proposals being exchanged can produce a path back to negotiations. The US airline measures are due to take effect the following day.