|
Apollo BAC AR-924
Exploding Hezbollah electronic devices · 2024
On 17 September 2024, thousands of pagers of the Lebanese terrorist
organisation Hezbollah exploded more or less simultaneously.
Around 5000
pagers had been obtained by Hezbollah shortly before the incident,
4000 of which exploded that day, after receiving a specially crafted
message. In the incident, at least 12 people were killed
and around 2750 were injured.
A day later, more than 400 handheld radios (walkie-talkies)
used by Hezbollah also exploded.
Although there was no direct proof, it was widely speculated that
Israeli services were behind the attack.
Israeli Government officials have meanwhile confirmed that Israel
was behind the attack [33].
|
The AR-924 pager from the Taiwanese manufacturer
Gold Apollo is intended for use on local infrastructure
in the 450-470 MHz UHF radio band,
and does not depend on PSTN.
Hezbollah used these pagers for security reasons, as they were afraid that
their communications via public networks could be intercepted or cut-off.
It seemed that the pagers had been manipulated
somewhere in the supply chain between Taiwan and Lebanon,
or that a special (fake) company had been setup by an intelligence service
to supply manipulated devices to Hezbollah [1].
|
|
|
Experts think that Israeli intelligence services managed to manipulate
the firmware and added a small (plastic) explosive device.
The Taiwanese manufacturer – Gold Apollo –
denied that the devices were
supplied by them, and suggested that they might have been supplied by
Hungarian company BAC Consulting Kft.
BAC had purchased the production rights
and the use of the brand name for certain regions,
and later produced their own pagers under the
Apollo brand [2].
A specially crafted message was sent to the newly purchased devices,
which triggered a small plastic explosive device that was hidden inside
its enclosure. According to the German newspaper Welt, the explosive
RDX [4] had been integrated into the batteries. In addition, the markers that
are normally present in plastic explosives to reveal them in an x-ray scan,
were said to have been omitted. Other sources report that the explosive
pentaerythritol tetranitrate, also known as PETN, pentyl or penthrite,
was used [9]. RDX and PETN are the main ingredients of Semtex [10].
Although it was widely assumed that the Israeli intelligence services
and the Israeli Army were behind the attacks, the Israeli Government
initially denied any involvement. But on Monday 11 November —
almost two months after the attacks — a spokesman for Prime Minister Benjamin
Netanyahu's office confirmed for the first time that Israel was behind the
devastating attacks on Hezbollah, which the Prime Minister had
personally approved [33].
➤ More about the AR-924 pager
|
 |
|
Improvised explosive device
IED
|
|
|
|
An improvised explosive device (IED) attack is the use of a homemade bomb
and/or destructive device to destroy, incapacitate, harass or distract.
They are generally used by criminals, vandals, terrorists, suicide bombers
and insurgents [27]. In this case, it appears to have been used by an
intelligence service. An IED, such as the subject of this page,
consists of these five elements:
|
- Switch ✔
- Power source ✔
- Initiator
- Explosive charge
- Container ✔
|
When using pagers like the Gold Apollo AR-924, and handheld radios
like the ICOM IC-V82, three of the required components of an IED are already present.
Below we will examine the implications for both device types.
|
|
|
Gold Apollo AR-924 rugged pagers
|
|
|
By using a pager, such as the AR-924, three of the required components of an
IED arealready present: the container (i.e. the device's enclosure), the power
source (the rechargeable battery) and the switch. The latter can be
an electric pulse generated by the existing hardware (i.e. the microcontroller),
under control of the internal software (firmware), that activates or triggers
the detonator and, hence, the explosive charge.
Below is the block diagram of the AR-924 pager.
All that is needed to convert it into an IED, is the addition of an
explosive charge, such as Semtex, and an initiator or detonator. It also
requires the devices firmware to be rigged, but as the device was already
advertised as having an improved user interface, that should be relatively simple.
The diagram above shows an educated guess of the internal construction of the
AR-924 pager. Note that the battery
takes about half the volume of the case.
It was developed especially for this application and carries the
model number LI-BT783.
It has four contact terminals: two for (+) and (-) power and two
for the internal protection circuit. The latter were used to trigger the
explosion.
➤ More about the AR-924 pager
|
It is currently unclear how the pagers were triggered and how the fatal message
was sent through the network: as a broadcast or as a series of individual messages.
In the latter case, it would take substantially more time to address all
subscribers, by which time some operatives might already have been warned.
Clearly, sending the message as a broadcast would have the most impact.
According to Reuters, the pagers started exploding around 15:30 and the
explosions lasted for approx. one hour. This could indicate that the messages
were sent individually, but it could also be a broadcast that was
repeated several times in order to reach people who initially had their pager
switched off.
If the triggering message was sent through Hezbollah's paging infrastructure,
it implies that it had been hacked by the the Israelis. Alternatively, the message
could have been sent from an airplane or drone at high altitude, by impersonating a
paging base station.
According to The Washington Post (WP), the following message was sent
to the pagers in Arabic [31]:
You received an encrypted message
Hezbollah operatives
then had to press two buttons simultaneously in order to read the coded
message. This action triggered the explosive charge, causing maximum damage
to both hands and probably also the eyes.
Less then a minute later, the remaining pagers exploded, regardless of
whether they were touched [31]. This implies that the 'special message'
was used to arm the device and start a count down timer. The explosive charge
detonated as soon as the counter reached zero, or when the user pressed the
two buttons in the meantime.
Although the triggering message was clearly not an encrypted one
— using just two buttons to decrypt it would not be great security —
it seems plausible that confidential
messages were not immediately shown on the display, but required some level
of user intervention. It is probably this method of sending confidential or
secured messages, that the WP article is referring to. WP also
claims that the rigged devices were manufactured in Israel under
supervision of the Mossad [31].
|
|
|
ICOM IC-V82 handheld radios
|
|
|
|
A day after the incident with the Apollo pagers,
on 18 September, a similar thing happened to the
two-way handheld radios that were also used by Hezbollah [5]. In this
case it involved the IC-V82 handheld radio, a 20 year old model
from the Japanese manufacturer ICOM. The IC-V82 works in the VHF amateur
radio band, which ranges from 144 to 146 MHz (optionally 136-174 MHz).
|
The ICOM IC-V82 is a straightforward two-way radio of the kind that
are also used by Amateur Radio Operators (HAMs). It was discontinued around
2014, and should no longer be available on the market. ICOM
stressed that the devices had not been supplied by them [7].
It is known however,
that counterfeit IC-V82 radios (i.e. not manufactured by ICOM) are widely
available.
Counterfeit radios are commonly produced in
China and are difficult to distinguise from real ones [11].
They are available from electronics stores in Asia and come in
'original' packaging.
The image on the right shows a counterfeit IC-V82 radio that exploded on
18 September 2024. It was taken from a
video clip,
distributed on X by Nikhil Choudhary
[18].
It is clear that in this case it is not the battery that exploded,
but the front top. Aparently an explosive device had been placed
inside the radio, close to or inside the loudspeaker, which is the part
that is closest to the face when the radio is operated. This suggest that
it was the intention to cause maximum – potentially fatal – harm to the user.
|
|
|
The image on the right shows the rear side of an IC-V82 radio after the
explosion. The fact that the cast metal frame has been bended outward, proves
that the explosion came from the other side (i.e. the front of the radio)
and not from the battery, as suggested by several media. The battery was
simply blown off by the explosion.
This matches with the image above and confirms our theory that the explosive
charge was close to the loudspeaker, or perhaps even hidden inside it by replacing
the magnet by a smaller one and filling the remaining space with explosives.
|
|
|
|
In Bulgaria, an investigation was launched into a company in Sofia,
that might have been involved in the supply of counterfeit IC-V82 radios
from Asia to Hezbollah.
This is the same company – Norta Global Ltd. – that might have been involved
in suppying the AR-924 pagers.
Although Bulgarian authorities later denied the involvement of the company
in the attacks against Hezbollah, an Hungarian news outlet later confirmed
a link between Norta Global and the Hungarian company BAC Consulting
in the form of a substantial money transfer [26].
|
The number of radios (~450) is smaller than the number of exploded
pagers (~4000), but since they are larger, they carried more explosives
and were therefore more damaging.
It is currently unclear how and when the handheld radios were manipulated
and how they were triggered remotely, but we can make a few educated guesses.
The radio features CTCSS and DTCS — two techniques to
selectively open the radio's noice cancelling system (squelsh) with
analogue or digital tones. It is also possible to fit an optional
DTMF coder/decoder. The latter can be used to activate the pager
function of the device, by sending it a 3-digit DTMF user ID.
It is likely that a unique combination of the above techniques was used
to avoid premature detonation.
According to the WP, the walkie-talkies were inserted into Lebanon by
Mossad from 2015 onwards; nearly a year after their production by ICOM had
been discontinued. They were equipped with an oversized battery, a hidden
explosive device and a transmission system that gave Israel complete
access to Hezbollah communications. It gave them the best possible intelligence
for no less than nine years [31]. At present we have no idea how this might
have worked. Embedding a spying device inside the radio, such as a GSM module,
would certainly have been discovered by Hezbollah security specialists.
Furthermore, the handheld radios are unencrypted and are suitable for
short-distance traffic only, with limited support for repeater operation.
|
|
|
Who is behind the attacks?
|
|
|
Although there is no direct evidence, it is widely assumed by international
experts, that the whole operation was planned and executed by the Israeli
intelligence services Mossad, in cooperation with the
Israeli Defense Forces (IDF). To hide the fact that the pagers were actually
manufactured by or on behalf if the Israelis, a complex web of intermediate
shell companies was created.
Although much is still unclear, this is how we think the companies were related:
The original manufacturer and owner of the Apollo brand name, is the Taiwanese
company Gold Apollo. This small electronics company, founded and owned by
Hsu Ching-kuang, manufactures and sells pagers worldwide. He claims
that his company did not manufacture the exploded AR-924 pagers, but that
instead they were made by BAC Consulting in Hungary to whom they had
licensed the design and the use of the Gold Apollo brand name,
for US$15 per sold unit [28].
This makes BAC Consulting the first company to be exposed after it became
apparent that the original manufacturer Gold Apollo in Taiwan had not made the
devices. According to investigating journalists of the Hungarian news outlet
Telex, it is most likely that BAC was just an empty body created especially
for this purpose, with a probably unwitting CEO at its helm [24].
BAC had obtained the reproduction rights to the pager, but had no production
facilities of its own.
BAC Consulting also seems to be company behind a newly founded Taiwanese
company by the name of Apollo System Ltd. This company was not related to
Gold Apollo, although it was headed by Theresa Wu, a former Gold Apollo employee
who left the company around the time the deal with BAC was finalised.
Apparently, Apollo Systems Ltd. handled the sales and marketing of the
AR-924, as it was
featured on its (now defunct) website Apollo Systems HK [25]. 1
However, the actual manufacturing was done elsewhere, probably in Israel or Hong Kong.
Another company involved in the web of shell companies seems to be the
Bulgarian company Norta Global, founded in Sofia by a Norwegian
national around the same time as BAC Consulting. Although the Bulgarian
security service DANS confirmed that the pagers had never physically
been in Bulgaria, the Hungarian news outlet Telex revealed that there
had been a flow of money from Norta Global to BAC Consulting, confirming
a link between the two companies [26].
|
 |
-
Confusingly, Apollo Systems HK, advertised the product as
Gold Apollo Rugged Pager AR-924, suggesting that it was a product
made by Gold Apollo in Taiwan [25]. In reality though, it was manufactured
by them — probably in Hong Kong — under licence from Gold Apollo, for which
they payed USD 15 per sold unit.
|
|
|
BAC Consulting KFT
Hungary
|
|
|
|
According to the Taiwanese manufacturer of the pagers, their Hungarian
license holder BAC Consulting Kft.
could be involved in the rigging of
the devices. The company was founded on 5 May 2022 and reported
an annual turnover of just EUR 549,420 in 2023 [6]. It is like that it
was a shell company, created especially for the pupose of selling rigged
equipment to certain parties.
|
|
A day after the incident, a representative of the Hungarian president
Viktor Orbán, told the press that the pagers had never actually been
in Hungary, and that BAC merely acted as an intermediary [8].
When reporters visited the company at its registered address [6],
no BAC representative was available for comment. At the address –
a modest office building in the outskirts of Budapest –
several other
(unrelated) companies were housed, and no one had seen the BAC
director since the pager attacks of 17 September [14].
She had reportedly been placed under the protection
of the Hungarian security services [15].
|
|
|
The person registered at the Hungarian Chamber of Commerce as the CEO
is Christina Bársony-Arcidacono, a 49 year old Hungarian-Italian
multi-lingual physics PhD and businesswoman, who apparently just lend her
name to the company, without actually being involved in its business.
The CEO has meanwhile been questioned by Hungarian authorities,
and has turned over paperwork, such as contracts, invoices and receipts
that might be related to the pager business [26].
|
|
|
Norta Global Ltd.
Bulgaria
|
|
|
Two days after the attacks, on 19 September 2024, Bulgarian authorities
also started an investigation into a company that they thought might have
facilitated the sale of pagers to Hezbollah. Although the name of
that company wasn't disclosed, Bulgarian media discovered
it was Norta Global Ltd. in Sofia (Bulgaria) [12].
This company, owned by Indian-Norwegian Rinson Jose (also: Hose Rinsan),
was founded on 14 April 2022, just weeks before BAC Consulting was founded
in Hungary.
Like BAC, Norta has its headquarters in a local office building
along with 196 other (unrelated) companies.
In a preliminary statement, the Bulgarian state security service DANS
said that it had not detected any shipments of the pagers on Bulgarian
territory [19].
They later stated that they had found no evidence of the involvement of
the company in the attacks against Hezbollah [22].
The paperwork handed over by Christina Bársony-Arcidacono in Hungary however,
reveals a connection between Norta and BAC [26]. Over the course of
several months, a total of more than one million Euros was transferred
from Norta to BAC in several installments. Part of this was payed to
Gold Apollo – probably the licensing fee – whilst another sum was transferred
to Apollo Systems in Taiwan [26].
|
|
|
Ellenberg Trading
Switzerland
|
|
|
Another mysterious name that appears to be involved, is that of the Swiss
company Ellenberg Trading. The company has – according to the Hong Kong
Chamber of Commerce – a seat in Hong Kong, and is alledgedly owned by mrs.
Pauline Ellenberg of Zürich (Switzerland).
However, Ellenberg is neither known by the
Swiss post nor by the Swiss Internal Revenue Service (tax office). There are
therefore doubts about her existence [32]. Norwegian journalists discovered
that a substantial amount of money was transferred from Ellenberg to
a company in Bulgiaria [Norta Global] which then transferred it
to a company in Hungaria [BAC Consulting].
|
|
In a remarkable interview with Lesley Stahl of the CBS News program '60 Minutes'
on 22 December 2024, two anonymous Mossad officers admitted that Mossad was indeed
behind the operation [34]. The officers, who wore masks and had their voices
altered, give a detailed description of how the operations was planned (10 years
earlier) and executed. They confirmed that the pagers as well as the walkie-talkies
had been manufactured in Israel.
|
Crypto Museum comment —
At present,
we have our reservations about some of the claims made during the interview.
For example: Mossad officer 'Michael' claims that the explosive device was
hidden inside the battery of the ICOM IC-V82 handheld radio.
We find this unlikely. The available photographic evidence confirm that
the explosion came from inside the radio itself and that the battery was
blown off, not the other way around.
According to Yossi Melman of the Israeli newspaper Haaretz, the decision
by Mossad chief David Barnea to officially admit responsibility for the
'pagers operation' was a propaganda move. It elevates his profile, boosts
the morale of the organisation, and indirectly serves the political and
personal interests of Israel's Prime Minister Benjamin Nethanyahu [35].
|
The international publicly funded investigation collective Bellingcat,
has meanwhile analysed and geolocated the available footage [30].
First of all, Bellingcat confirms that some pagers have exploded in people's
hands, whilst others exploded on people's hips.
In the video of a man in a grocery store,
the pager was probably carried in the bag, or on the hip just behind the bag.
Bellingcat also identified a second person that is somehow linked to
BAC Consulting. This mysterious person, by the name of 'Eric Hansen',
has a Linked-In page, but all references to former schools and businesses
appear to be dead ends. It is likely that this person does ot exists or that
the name is used as an alias.
|
|
|
Pagers explode across Lebanon, killing nine and injuring 2,800 people
|
|
|
This footage from security cameras were shared on social media moments
after the attacks. It shows a person shopping at the Yahay's Supermarket
in Haret Hreik [30], and another
one standing at the counter in a shop.
The first person does not operate the pager, whilst the
other one tries to read a message.
source
TNIE Videos
Date
18 September 2024
|
|
|
|
|
Israel actually made these pagers
|
|
|
This YouTube video explains how Israel managed to not only rig the Hezbollah
pagers, but actually manufacture them under the cover of several shell
companies.
Source
CNN-News18
Date
19 September 2024
|
|
|
- So könnten die Hisbollah-Pager manipuliert worden sein
This is how Hezbollah pagers could have been manipulated (German).
N-tv, 17 September 2024.
- Gold Apollo says Budapest-based BAC produces model of pagers used in Lebanon blast
Reuters, Ben Blanchard. 18 September 2024.
- Alfred Hockensberger, Es befand sich Plastiksprengstoff RDX in de Batterien
Welt, 18 September 2024.
- Wikipedia, RDX
Visited 18 September 2024.
- Weitere Hisbollah-Geräte explodieren im Libanon - 100 Verletzte
More Hezbollah devices explode in Lebanon - 100 injured (German).
N-tv, 18 September 2024.
- Chamber of Commerce, company information
Visited 18 September 2024.
- Japan Firm Says Devices Reportedly In Hezbollah Blasts 'Discontinued About 10 Years Ago'
Barrons, AFP, 18 September 2024.
- Orbán rep says Hezbollah exploding pagers were 'never' in Hungary
Politico, 19 September 2024.
- Wikipedia, Pentaerythritol tetranitrate
Visited 19 September 2024.
- Wikipedia, Semtex
Visited 19 September 2024.
- ICOM UK, Warning about counterfeit ICOM equipment
ICOM Inc., 2018.
- Bulgarije onderzoekt nu bedrijf gelinkt aan exploderende biepers
Bulgaria investigating company linked to exploding pagers (Dutch).
HLN, 19 September 2024.
- Wikipedia, 2024 Lebanon electronic device attacks
Visited 21 September 2024.
- The mystery woman whose company BAC Consulting is linked to exploding pagers
CNA, 21 September 2024.
- CEO of company linked to Hezbollah pagers being guarded by Hungarian secret services
Justin Spike, Paolo Santalucia and Sarah el Deeb,
The Times of Israel/AP. 20 September 2024.
- Bulgaria to probe local firm's links to Lebanon pagers
Baha Breaking News, Christian Baha/RR. 19 September 2024.
- Handheld Radios Used In Explosions Against Hezbollah
YouTube, Ham Radio Crash Course. 19 September 2024.
- Videos showing exploded handheld 'IC-V82' radio
X, Nikhil Choudhary, 18 September 2024.
- Bulgaria opens probe into local company linked to Israeli-tampered pagers
The Cradle, News Desk. 19 September 2024.
- Lebanon terror attacks 'long in the making' Israeli op: Report
The Cradle, News Desk. 19 September 2024.
- How Israel Built a Modern-Day Trojan Horse: Exploding Pagers
The New York Times, 18 September 2024.
- Bulgaria denies Sofia-based firm had any link to pager attacks in Lebanon
AA, Ahmet Gençtürk. 19 September 2024.
- Israel concealed explosive devices inside batteries of pager sold to Hezbollah, Lebanese officials say
CNN, Tamara Qiblawi et al. 27 September 2024.
- Pager blasts: 'Mossad companies' in Budapest and Sofia appear to be shell companies, not front firms
Telex. Dezsö András & Andrea Horváth Kávai. 22 September 2024.
- Gold Apollo Rugged Pager AR924 (archived)
Product page on Apollo Systems Hong Kong website (meanwhile taken down).
Apollo Systems HK, 17 September 2024 (via WayBack Machine).
- Hungarian-Italian woman implicated in pager blasts turned contracts and invoices over to authorities
Telex. Dezsö András & Andrea Horváth Kávai. 26 September 2024.
- IED Attack - Improvised Explosive Devices - fact sheet
Department of Homeland Security (USA).
- The prosecutor continues to track down the pager explosing case...
ET Today, 23 September 2024 (translated).
- Raphael Wimmer, A small #OSINT thread about the AR-924 pager...
Mastodon, 26 September 2024.
➤ Similar thread on X (Twitter)
- Mystery Profile Linked to Hungarian Firm Implicated in Exploding Pagers
Foeke Postma, Logan Williams and Jake Godin.
Bellingcat, 20 September 2024.
- Mossad's pager operation: Inside Israel's penetration of Hezbollah
The Washington Post, 6 October 2024.
- Jonas Bucher, Name eibner Schweizerin taucht im Fall der pager-Explosionen auf
20 Minuten, 4 October 2024.
- Nethayahu's office confirms Israel was behind devastating pager attacks on Hezbollah
The Times of Israel, 11 November 2024.
- Former agents from Israel's Mossad detail how they built and sold
explosive pagers to Hezbollah terrorists
Lesley Stahl, 22 December 2024.
- The Real Reason Why Israel's Mossad Cooperated With
'60 Minutes' Tell-all on Hezbollah Pagers Attack
Yossi Melman, Haaretz, 24 December 2024.
|
|
![Counterfeit 'IC-V82' handheld radio of which the front top has exploded. Image taken from video on X [18].](img/ICV82_exploded.jpg)
