|
|
|
|
|
|
Rigged explosive radio pager
- wanted item
AR-924 is an alphanumeric pager for the 460 MHz band, marketed
between 2022 and 2024 by
BAC Consulting Ktf. in Budapest (Hungary) under the Gold Apollo brand,
licenced from the Taiwanese company Gold Apollo in 2021.
Around 5000 AR-924 pagers were supplied to the
Lebanese terrorist organisation Hezbollah, where they were used for
high-level one-way communication. On 17 September 2024, about 4000 AR-924
units exploded almost simultaneously [3].
|
According to the supplier/manufacturer, it is a ruggedised version of the well-known
AL-924 that was marketed by Gold Apollo. It comes in a strong IP67-rated
enclosure and has a USB-C rechargeable battery that lasts for up to 85 days.
Unlike other Apollo pagers, that were developed and marketed by Gold Apollo
in Taiwan, the AR-924 was developed by or on behalf of the Hungarian
company BAC Consulting Kft. in Budapest. The devices were sold however under
the Gold Apollo brand, which had been licenced to them.
It is currently unclear where they were made.
|
|
|
Pagers were popular in the 1980s and 90s, but their function has mostly been
superceeded by the SMS facility of mobile phones. Nevertheless, they are
still widely used, in particular by closed groups like the emergency services.
In some countries, paging services are still offered by commercial service
providers. Although paging services can be operated in several
frequency bands — notably 100-174, 400-470 and 929-932 MHz — the
150-174 band is the most popular one, as its signals penetrate concreate more
easily. A pager will generally work in situations where a mobile phone
has no coverage, 1 such as in basements.
In addition, a pager uses far less energy. It runs for weeks
on a single battery charge, whereas a mobile phone must be recharged daily.
Unlike a mobile phone, which allows two-way traffic, a pager is a one-way device.
It can only receive and display messages sent through a (local) infrastructure.
It cannot confirm the receipt of a message and, hence, does not reveal its location.
In addition, the infrastructure needed for a paging network, is usually
separate from the mobile telephone network. in some cases though, a gateway
allows messages to be sent to a pager from a telephone or from a PC
via the internet.
|
 |
-
Generally speaking, the higher the frequency, the more difficult it is
for the signal to penetrate obstacles. As mobile phone providers keep
raising the frequency (to gain more bandwidth) it will be increasingly
diffult to use 4G and 5G phones in a basement, unless additional nodes
are placed in its vicinity.
|
The image below provides a quick overview of the controls and features
of the AR-924 pager. The device is housed in a plastic enclosure with
rounded corners, that measures 73 × 50 × 27 mm and weights 95 grams,
battery included. The device can run for 85 days on a single battery charge,
which is why the battery takes up about half the available space. It can
be charged from the USB-C port of a PC or laptop, or with a standard battery
charger with a USB-C connector.
A large part of the frontpanel is taken up by the transflective
backlit 144 × 64 pixel liquid crystal display (LCD). Four push-buttons
are integrated with the lower edge of the enclosure. A buzzer is located
to the right of the display. Also present, but not visible, is an
integrated vibrator.
|
- Strong buzzer
- Improved user interface
- 85 day battery life
- USB-C battery charging in 2.5 hours
- 4-button operation
- Mesage preview (scroll-down list)
- Battery level indicator
- Signal strength indicator
- Stopwatch function
- Backlit LCD display
- PC programmable and hand programmable
|
|
According to the website [13], the device had spring-loaded contacts for a
replaceable Lithium battery, which
could be recharged in 2.5 hours, and power the device for no less than 85 days.
It was probably created especially for this purpose and is likely to have
cointained the explosives.
|
According to the specifications, it measures 40 × 34 × 18 mm and weights 35 g.
It delivers 7.4V and has a capacity of 300 mAh (2.2 Wh).
The image on the right shows the battery as it was offered on the Apollo System HK
website [15].
The battery has four gold-plated contacts that mate with the four gold-plated spring
contacts inside the pager. The two outer contacts are the (-) and (+) terminals
of the battery. The remaining two contacts are connected to the built-in Protection Circuit
Module (PCM). A PCM is normally used to prevent the battery from overcharging,
overheating and deep-discharging.
In this case it also triggered the explosive charge.
|
|
|
The battery is large enough to house a high-capacity Li-ion battery, plus a detonator
and an explosive charge. The trick was in this case, to conceal the exposive charge in
such a way that it would not be noticed with an x-ray scan. This means that it was
probably embedded within the layers of the battery, and that the markers that are
usually present to reveal plastic explosives like PETN and RDX (the ingrediants of Semtex)
during an x-ray scan, were deliberately omitted.
The battery is clearly different from the ones that were used by Gold Apollo.
These were always regular AA-size batteries.
According to the text on the battery, it was MADE IN CHINA, but there is no
sign of a manufacturer name. It seems likely that the single-source nature of
the battery and the absence of a manufacturer name caused concern at Hezbollah.
In January and February 2023, someone asked questions about it on two different online forums,
but got no reply [14]. This was probably around the time when AR-924 sample(s) had been delivered
to Hezbollah.
These concerns must have been picked up at the other side, as in September and October 2023,
two (probably fake) online battery webshops came online, both offering the LI-BT783 [14][16].
This was probably enough to satisfy Hezbollah. Both webshops have since disappeared.
|
The Lebanese terrorist organisation Hezbollah started using the old-school
pagers around 2021, after the suspcion arose that arch enemy Israel
was not only able to intercept their communications, but could also
determine their location and could potentially manipulate the devices.
This is not unfounded, as much of the software for (lawful) telephone
interception is developed in Israel. Furthermore, Israeli companies like
NSO Group,
have been in the news regularly for rigging mobile phones, including Apple's iPhone.
Such parties are generally linked to Israeli intelligence.
By using old technology, Hezbollah thought to have found a more secure way
of communicating with its operatives. This was amplified by Hezbollah leader
Hassan Nasrallah, when in early 2023 he called upon his followers to throw
away their mobile phones and buy a pager instead. As a result, the organisation
needed more pagers, which were obtained through BAC Consulting.
|
|
On 17 September 2024 at 15.30 local time, a message was sent to all 5000 pagers
of the Hezbollah group. The message appeared to come from Hezbollah leadership.
Seconds later, approx. 4000 of the devices exploded, killing several people
and injuring thousands others. Among the victims were not only Hezbollah operatives,
but also innocent bystanders and even children.
|
In the hours after the attack, several picures of the remains of exploded
AR-924 devices were posted on the internet, such as the one shown in the image
on the right. The images and the live footage from several security cameras,
confirm that the blasts were not caused by overheated Lithium batteries,
but by explosive devices.
Several sources confirmed that explosives like RDX and PETN had been
found, both of which are the core ingredients of Semtex.
Only a small amount of RDX or PETN is needed for a lethal explosion
like the ones in the published footage.
|
|
|
|
A day after the incident with the Apollo pagers – on the 18th –
a similar thing happened to the
handheld two-way radios that were also used by Hezbollah [6]. In this
case it reportedly involved the IC-V82 handheld radio — a 20 year old model
from the Japanese manufacturer ICOM. It works in the VHF radio band,
and is independent of the UHF paging network used by Hezbollah.
Production of the IC-V82 was abandoned 10 years prior to the attack (2014),
but counterfeit reproductions – presumably from China – were still widely available
from various outlets in Asia.
|
Although it is currently unknown who was responsible for the exploding devices,
it is widely speculated and believed by experts,
that an Israeli intelligence service
was behind it — probably the Mossad or Shin Bet — in cooperation with the Israeli
Armed Forces (IAF). In a carefully planned and executed covert operation, they
had not only managed to infiltrate the supply chain, but had also been
able to take over the manufacturing of the devices. This enabled them to
embed a small but powerful explosive device in the existing design, in such a way
that it would not be noticed by service personnel. It is likely that they
had also manipulated the device's firmware, so that the explosive device would
detonate upon receipt of a specially crafted message.
➤ More about the covert operation
|
|
Gold Apollo is a Taiwanese company that manufactures a range of pagers,
and sells them worldwide. The AR-924 seems to be a ruggedised version
of the AL-924 — at one time Apollo's most popular model that has meanwhile
been discontinued. Immediately after the incident with the exploding
Hezbollah pagers, Apollo's founder and president – Hsu Ching-kuang –
told the press that his company had nothing to do with the AR-924 model [4].
It was not manufactured by his company and had not been supplied by
them either. Instead, he claimed, the device was made the Hungarian
firm BAC Consulting, to whom they had licenced the design and
company logo.
|
|
|
Apollo Systems Ltd.
Taiwan, HongKong
|
|
|
Sales and marketing of the AR-924 were handled by a company in Hong Kong
by the name of the Apollo Systems HK Ltd. It (now defunct) website
featured the AR-924 pager [13], along with an
accompanying video on YouTube.
Apparently, this company was
a subsidary of Applo Systems Ltd. in Taiwan, which was headed by Theresa Wu,
a former employee of Gold Apollo. Apollo Systems Ltd. was reportedly a
subsidary of BAC Consulting in Hungary — the licence holder.
➤ See the (removed) AR-924 product page
➤ Watch the video
|
|
|
BAC Consulting Kft.
Hungary
|
|
|
BAC Consulting Ktf., abbreviated BAC, was an Hungarian company,
founded on 5 May 2022 and located in Budapest (Hungary).
According to Gold Apollo, they were involved in the production
and sales of the AR-924 pager — a rugged version of the AL-924 —
for which it had purchased the rights to pager's design and to the use
of the company's name and its logo.
A day after the incident, a representative of the Hungarian president
Viktor Orbán, told the press that the pagers had never actually been
in Hungary, and that BAC merely acted as an intermediary [7].
When reporters visited the company at its registered address [5],
no BAC representative was available for comment. At the address –
a modest office building in the outskirts of Budapest – several other
(unrelated) companies are housed, and no one had seen the BAC
director since the pager attacks on 17 September [8].
According to several media, the
company's registered owner has been placed under protection of the
Hungarian security services since the pager attacks [8].
It is possible, if not likely, that BAC and Apollo Systems Ltd. were
shell companies,
created specifically for supplying the rigged pagers to Hezbollah.
So far, it remains a mystery where the pagers were actually made,
but it is possible that they were manufactured by Apollo Systems in Hong Kong
and supplied to Hezbollah either directly or through yet another shell company.
|
|
|
Norta Global Ltd.
Bulgaria
|
|
|
Two days after the attacks, on 19 September 2024, Bulgarian authorities
started an investigation into a company that they thought might have
fascilitated the sale of the pagers to Hezbollah. Although the name of
that company wasn't revealed, Bulgarian media discovered
it was Norta Global Ltd. in Sofia (Bulgaria) [10][11].
This company, owned by Norwegian citizen Rinson Jose, was founded
in April 2022, just weeks before BAC Consulting was founded in Hungary.
Like BAC, Norta has its headquarters in a local office building
along with 196 other (unrelated) companies.
In a preliminary statement, the Bulgarian state security service DANS
said that it had not detected any shipments of the pagers on Bulgarian
territory [12]. It was revealed though, that Norta had payed a substancial
amount of money to BAC Consulting, amounting to more than EUR 1 million.
➤ More about exploding Hezbollah devices
|
This clip was found on the YouTube channel of Apollo Systems HK in 2023.
It shows the AR-924 pager in operation and highlights its
unique features, like the improved user interface and the
85 day battery life.
Note that the name of the original manufacturer – Gold Apollo – is used
in the video, although in reality it was Apollo Systems HK that was
responsible for the design and sales.
Source
YouTube, Apollo Systems HK
Date
13 December 2022
|
|
|
Below is the block diagram of the AR-924 pager.
At the centre is the microcontroller (CPU) that forms the
heart of the device. It is driven by internally stored software
(firmware) and has interfaces to the controls, display, vibrator,
buzzer and radio modem. It also has a USB-C connection for altering the settings
from a regular PC, and to charge the internal Lithium-ion battery.
The battery is at the bottom. It was developed especially for this
project and consists of a Li-ion battery with a Protection Circuit Module (PCM),
a detonator and an explosive charge. It is likely that the explosive charge was
embedded within the layers of the battery, so that it would not be noticed
in an x-ray scan. The detonator was probably integrated with the PCM.
|
As far as we know there are currently no photographs of the interior
of te AR-924, apart from a few fragments that were photographed
immediately after the atacks. Below is an educated guess of the
internal construction of the device, based on an analysis of
Raphael Wimmer on X [14], complemented by our own observations and
insights. The enclosure consists of two plastic case shells, held
together by screws that are inserted from the rear. The upper case
shell contains the display window, the four knobs and holes
for the buzzer, the lanyard and the USB-C socket.
There are two printed circuit boards (PCBs). The upper one holds the
microcontroller, the display and the controls. The lower one holds
the radio interface, the buzzer, the USB-C socket and the antenna.
It is constructed in such a way that the battery contacts align with
the spring contacts on the lower PCB (not visible here). At present
it is not certain where the microcontroller (CPU) is located.
It could be on the upper board, but also on the
lower board.
|
Device Pager Purpose One-way closed-group wireless messaging Model AR-924 Supplier BAC Consulting Kft., Hungary Brand Gold Apollo Supplier Apollo Systems Ltd. Manufacturer ? Year 2022-2024 Frequency 450-470 MHz Spacing 25 kHz Deviation 4.5 kHz Rejection > 40dB Protocol POCSAG Data rate 512, 1200, 2400 baud Sensitivity -110dBm (512 baud), -108dBm (1200 baud), -106dBm (2400 baud) Capcodes 8, frame independent Messages 30 Characters 100 per message Display 146 × 64 pixels LCD 1 Language English Battery LI-BT783 rechargeable Li-ion Duration 85 days Charging USB-C (2.5 hours) Resistance IP67 Shock 1.5 m Approval CE Temperature -10°C to +50°C Dimensions (HWD) 50 × 73 × 27 mm Weight 95 g
|
-
The horizontal resolution of 146 pixels is highly unlikely as it is not
a multiple of 8. It is probably a typo and should be 144 pixels.
|
- Wikipedia, Gold Apollo AR924
Visited 20 September 2024.
- Wikipedia, 2024 Lebanon pager explosions
Visited 21 September 2024.
- Pagers Explode Across Lebanon in Apparent Attack on Hezbollah
New York Times, 17 September 2024.
- Gold Apollo says Budapest-based BAC produces model of pagers used in Lebanon blast
Reuters, Ben Blanchard. 18 September 2024.
- Chamber of Commerce, company information
Visited 18 September 2024.
- Exploding Hezbollah devices
Crypto Museum, 17 September 2024.
- Orbán rep says Hezbollah exploding pagers were 'never' in Hungary
Politico, 19 September 2024.
- The mystery woman whose company BAC Consulting is linked to exploding pagers
CNA, 21 September 2024.
- CEO of company linked to Hezbollah pagers being guarded by Hungarian secret services
Justin Spike, Paolo Santalucia and Sarah el Deeb,
The Times of Israel/AP. 20 September 2024.
- Bulgarije onderzoekt nu bedrijf gelinkt aan exploderende biepers
Bulgaria investigating company linked to exploding pagers (Dutch).
HLN, 19 September 2024.
- Bulgaria to probe local firm's links to Lebanon pagers
Baha Breaking News, Christian Baha/RR. 19 September 2024.
- Bulgaria opens probe into local company linked to Israeli-tampered pagers
The Cradle, News Desk. 19 September 2024.
- Gold Apollo Rugged Pager AR924 (archived)
Product page on Apollo Systems Hong Kong website (meanwhile taken down).
Apollo Systems HK, 17 September 2024 (via WayBack Machine).
- Raphael Wimmer, A small #OSINT thread about the AR-924 pager...
X (Twitter), 26 September 2024.
- LI-BT783 Lithium-ion Battery pack
Apollo Systems HK, 17 September 2024 (Retrieved via WayBack Machine).
- LI-BT783 Lithium-Ion Battery pack
Electronics Power, 18 July 2024 (Retrieved via WayBack Machine).
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Last changed: Thursday, 03 October 2024 - 21:26 CET.
|
|
|
|
|
