Oliver Waters, Sara Feletto, Itamar Raizman, Lewis Li, Jigyasa Maloo CENTCOM
Finley Thomas, Angelina Sammarco, James Raggio, Sakura Morales, Editor; Evan Beachler, Elena Alice Rossetti, Senior Editor
September 17, 2024
Pager[1]
The Counterterrorism Group (CTG) is issuing a FLASH ALERT after a wave of pagers exploded in Lebanon and Syria at approximately 1530 local time.[2] The explosions were allegedly linked to the lithium batteries in pagers that Hezbollah Leader Hassan Nasrallah introduced last year when he ordered a switch from smartphones to older technologies such as pagers and landlines due to the perceived cyber security risk.[3] Hezbollah fighters and medics have been affected by these incidents, with early reports suggesting the explosions have injured approximately 3000 people, including Iran’s ambassador to Beirut, Mojtaba Amani.[4] Hezbollah accused Israel of carrying out the attack, but Israeli authorities declined to comment about the explosions.[5] Lebanon's health ministry urged hospitals to prepare for emergency patients and instructed health workers to avoid using wireless devices.[6]
CTG is on HIGH alert for retaliatory attacks by Hezbollah against Israel, LIKELY using drone or rocket attacks. Damage to Hezbollah’s communication infrastructure will LIKELY delay their response. The casualties from the attack will LIKELY strain hospitals due to the influx of patients. These problems will VERY LIKELY undermine domestic trust in Hezbollah and will VERY LIKELY increase anti-Israel sentiment in Lebanon. Israel and other groups in the Middle East and elsewhere will LIKELY employ cyber-warfare tactics in asymmetric warfare to exploit vulnerabilities in lithium-ion battery technology to achieve their objectives.
On September 17, 2024, pagers in Lebanon and Syria began to explode at around 1530 local time. Explosions mostly occurred in the southern suburbs of Beirut, in South Lebanon, and in the Bekaa Valley, areas with a high concentration of Hezbollah supporters and members. Fourteen people, including several Hezbollah members, were also wounded in Damascus and Rif Dimashq governorates.[7] Reuters initially has identified the pagers as allegedly being produced by Gold Apollo, a Taiwanese wireless transmitter company that has denied producing the devices, instead claiming that BAC was the manufacturer.[8] Images of detonated pagers appear consistent with Gold Apollo’s AR-924 model, powered by lithium batteries that could have been tampered with to overheat and explode.[9] Lebanese security officials, suggested that the detonation occured due explosives planted inside the pagers, allegedly by Mossad.[10] Lebanese authorities and emergency services are on high alert. The Lebanese foreign ministry has labeled the incident as an "Israeli cyber attack"[11] and a “major violation of Lebanese security and sovereignty” and has vowed to bring the issue to the UN Security Council (UNSC) upon gathering all relevant information.[12] The education ministry has announced the closure of all educational institutions on September 18.[13] The Lebanese health minister, Firas Abiad, has stated during a press conference that nine people have died so far, including a young girl, and nearly 3,000 have been wounded, 200 of whom are in critical condition.[14] Reuters reported that many of the injured were fighters closely linked to Hezbollah leadership.[15] Hospitals nationwide have activated to take in patients, including the full mobilization of all staff at the American University of Beirut Medical Center.[16]
This incident will likely escalate the ongoing conflict between Israel and Hezbollah through direct military action, as the group will likely attempt retaliation attacks against Israel. Hezbollah depends on older technologies and likely lacks the technical expertise in cyber operations to retaliate against cyber operations to the same extent. To account for this asymmetry in cyberspace, Hezbollah will likely use increased kinetic operations, including drone strikes, unguided rocket attacks, and terrorist attacks against Israel. Tehran and its proxies, Hamas and the Houthis, will likely carry out further rocket attacks against Israel to support Hezbollah’s operations, given the explosions injured an Iranian ambassador.
The operational implications of the pager explosions will likely delay Hezbollah’s response. The group’s command and control capabilities will likely decrease, as orders will likely be delivered by landline phones and runners, given that Hezbollah does not use mobile phones for communication. Hezbollah units will likely be under-strengthened and demoralized, as the exploding pagers likely injured their members. These limitations will likely hinder Hezbollah's ability to quickly inform its fighters of Israeli movements, which will likely increase the group’s vulnerability to Israeli airstrikes and ground operations.
The attack will very likely increase anti-Israel sentiment among the Lebanese public due to the high amount of injuries and the magnitude of the incident. Lebanese authorities will likely adopt stricter political and diplomatic measures against Israel, likely lodging formal complaints at the UN, and calling for economic sanctions targeting Israel’s cybersecurity industry likely to reduce its capability to carry out further cyber attacks. They will likely face public pressure to implement tougher security measures and increase their involvement in the ongoing conflict. Sympathy towards affected Hezbollah members will very likely be high and will likely lead to increased support for Hezbollah and heightened opposition against Israel across Lebanon. Despite the favorable public sentiment, Hezbollah will likely face internal challenges against leadership for the choice to substitute mobile phones with the AR-924s and the inability to prevent the attack, which have a roughly even chance of decreasing the effectiveness of coordination and disrupting other military operations.
Hospitals in Southern Lebanon and Beqaa will very likely be overwhelmed due to the large number of casualties involved in this incident. Medical staff in Lebanese hospitals will very likely have to stop using internal pagers due to the explosion risk, likely reducing their ability to react effectively to a patient’s needs. The strain on the health service is unlikely to decrease in the long term as debris from the incident will likely contain hazardous materials. These hazardous materials will likely cause further casualties after the incident.
Cyber warfare techniques, such as supply chain attacks, distributed denial of service (DDoS), and exploitation of hardware or software vulnerabilities, will likely become more common in asymmetric conflicts as they provide plausible deniability. Israel is very likely behind the explosions and will almost certainly continue to use cyber warfare to achieve its goals. Exploiting lithium batteries in pagers will likely set a precedent for future cyber attacks, and malicious actors will likely try replicating the idea. Given the widespread use of lithium batteries in consumer electronics, this attack will very likely raise the chances of similar incidents targeting devices like smartphones, laptops, and electric vehicles. This threat almost certainly puts millions at risk of injury or property damage and will very likely erode trust in technological products. The pagers were likely compromised using a supply chain attack, in which malicious actors target hardware or software vulnerabilities during a product's production or distribution. Technology companies are almost certainly at risk of similar cyber attacks as many outsource the production of components like batteries and software to third-party suppliers.
CTG recommends that Lebanese medical facilities activate emergency protocols and implement mobile field hospitals to address the overwhelming number of casualties.
CTG recommends that better-equipped medical facilities engage in resource and personnel-sharing efforts to assist the most affected and under-prepared hospitals.
CTG recommends that airlines prepare emergency plans to evacuate foreigners from Lebanon and Israel in case of further escalation with close coordination of government authorities and embassies.
CTG recommends that foreigners in Lebanon and Israel remain on high alert and follow directions from embassies regarding their presence in the countries and secure courses of conduct, avoiding areas affiliated with Hezbollah strongholds and moving away from conflict-prone areas.
CTG recommends that Lebanese authorities develop long-term plans to clean up and remove hazardous debris, such as lithium battery fragments, to reduce further health risks.
CTG recommends that Lebanese authorities and international organizations launch full, independent, and transparent investigations into the event, upholding international standards to deter similar future attacks.
CTG recommends that individuals and organizations in Lebanon immediately suspend the use of pagers and similar wireless communication systems until full information on the attack is available and authorities have confirmed that the situation is under control.
CTG recommends that critical sectors such as medical services, emergency response teams, and police and security forces implement adequate security measures, such as enhanced cybersecurity protocols, physical security, and close coordination, across sectors to avoid operational compromisation during the crisis.
CTG recommends that institutions relying on pagers for communication develop plans to transition to more secure systems beyond the current emergencies to prevent future vulnerabilities.
CTG recommends that Lebanese and Israeli authorities maintain vigilance of possible disinformation campaigns aimed at exacerbating tensions between both countries and further destabilizing the region.
CTG assesses that the current threat climate is HIGH due to the potential for further attacks by Israel exploiting the current state of emergency, as well as potential retaliation from Hezbollah. Hezbollah will likely seek retribution, escalating tension between Israel and Lebanon into a direct military confrontation. Hezbollah will almost certainly retaliate with kinetic operations, such as rocket or drone strikes, to compensate for its inability to counter the cyber attacks. It will likely increase the threat of attack from Iran and its proxies, Hamas and the Houthis, against Israel. The incident will likely strain Lebanon's health services, as contaminated debris will likely increase casualties in the long term. Threat actors will very likely exploit the cyber attack and will likely become a common tactic in asymmetrical warfare. The industry-wide vulnerability and widespread presence of lithium-ion battery technology in consumer products will likely increase exposure to similar attacks, almost certainly putting millions at risk of injury or property damage.
Analysis indicates that there is a HIGH PROBABILITY conflict between Hezbollah and Israel will escalate, with both sides VERY LIKELY engaging in kinetic attacks. The incident will LIKELY delay Hezbollah’s response due to operational implications, which Israel will VERY LIKELY exploit. The magnitude and the impact of the attack will VERY LIKELY increase anti-Israel sentiment among the Lebanese public. Further casualties due to contaminated debris, including lithium-ion batteries and cobalt, will LIKELY pose a risk to the public after the incident. The cyber attack technique will LIKELY become a common tactic in asymmetrical warfare, employed and replicated by threat actors. The exploitation of lithium batteries LIKELY sets a precedent for future cyber attacks targeting consumer products such as smartphones, laptops, electric vehicles, and technology companies.
Unlock the Power of Knowledge with The Counter Threat Center! Elevate your threat detection capabilities with critical intelligence on global threats. Join us for a free trial and equip yourself to safeguard those you've sworn to protect. Click here to learn more: https://www.counterthreatcenter.com/subscriptions
[1] Pager, generated by a third party database
[2] A wave of exploding pagers in Lebanon and Syria kills at least 8, including members of Hezbollah, AP, September 2024, https://apnews.com/article/lebanon-hezbollah-israel-exploding-pagers-8893a09816410959b6fe94aec124461b
[3] Eight killed and thousands injured as Hizbollah pagers explode in Lebanon, Financial Times, September 2024, https://www.ft.com/content/37af2899-3b61-42c8-b359-9ae2e66e9aa4
[4] Hezbollah vows to punish Israel after pager explosions across Lebanon, Reuters, September 2024, https://www.reuters.com/world/middle-east/dozens-hezbollah-members-wounded-lebanon-when-pagers-exploded-sources-witnesses-2024-09-17/
[5] Hezbollah says Israel ‘Fully Responsible’ For Pager Blasts, BARRONS, September 2024, https://www.barrons.com/news/hezbollah-says-israel-fully-responsible-for-pager-blasts-2eea2ff5
[6] Eight killed and thousands injured as Hizbollah pagers explode in Lebanon, Financial Times, September 2024, https://www.ft.com/content/37af2899-3b61-42c8-b359-9ae2e66e9aa4
[7] Explosion of party communications equipment… 14 wounded in the capital and Damascus Countryside, Syrian Observatory for Human Rights, September 2024, https://www.syriahr.com/%d8%a8%d8%a7%d9%86%d9%81%d8%ac%d8%a7%d8%b1-%d8%a3%d8%ac%d9%87%d8%b2%d8%a9-%d8%a7%d8%aa%d8%b5%d8%a7%d9%84%d8%a7%d8%aa-%d8%ae%d8%a7%d8%b5%d8%a9-%d8%a8%d8%a7%d9%84%d8%ad%d8%b2%d8%a8-14-%d8%ac%d8%b1/728914/ (Translated by Google)
[8] What we know so far about the deadly pager blasts in Lebanon?, Reuters, September 2024, https://www.reuters.com/world/middle-east/what-we-know-so-far-about-deadly-pager-blasts-lebanon-2024-09-17/
[9] The Mystery of Hezbollah’s Deadly Exploding Pagers, Wired, September 2024, https://www.wired.com/story/pager-explosion-hezbollah/
[10] Hezbollah vows to punish Israel after pager explosions across Lebanon, Reuters, September 2024, https://www.reuters.com/world/middle-east/dozens-hezbollah-members-wounded-lebanon-when-pagers-exploded-sources-witnesses-2024-09-17/
[11] What we know so far about the deadly pager blasts in Lebanon?, Reuters, September 2024, https://www.reuters.com/world/middle-east/what-we-know-so-far-about-deadly-pager-blasts-lebanon-2024-09-17/
[12] More than 9 killed, including Hezbollah MP son, and 2,800 injured in Lebanon pager blasts: Day 347 of the Gaza war, L’Orient Today, https://today.lorientlejour.com/article/1427350/netanyahu-sets-return-of-israelis-evacuated-from-northern-israeli-towns-as-new-target-day-347-of-the-gaza-war.html
[13] Ibid
[14] A wave of exploding pagers in Lebanon and Syria kills at least 8, including members of Hezbollah, AP, September 2024, https://apnews.com/article/lebanon-hezbollah-israel-exploding-pagers-8893a09816410959b6fe94aec124461b
[15] Hezbollah vows to punish Israel after pager explosions across Lebanon, Reuters, September 2024, https://www.reuters.com/world/middle-east/dozens-hezbollah-members-wounded-lebanon-when-pagers-exploded-sources-witnesses-2024-09-17/
[16] Message to the Community, AUBMC, September 2024, https://aubmc.org.lb/Pages/Message-to-the-community-sep17.aspx