AR-924

Rigged explosive radio pager - wanted item

AR-924 is an alphanumeric pager for the 460 MHz band, marketed between 2022 and 2024 by BAC
Consulting Ktf. in Budapest (Hungary) under the Gold Apollo brand, licenced from the Tai­wan­ese company
Homepage Gold Apollo in 2021. Around 5000 AR-924 pagers were supplied to the Leba­nese terrorist organisation
Hezbollah, where they were used for high-level one-way communi­cation. On 17 September 2024, about
Crypto 4000 AR-924 units exploded almost simultaneously [3].

Spy radio
According to the supplier/manufacturer, it is a
Burst encoders ruggedised version of the well-known AL-924 that was
marketed by Gold Apollo. It comes in a strong IP67-
Intercept rated enclosure and has a USB-C rechargeable
battery that lasts for up to 85 days.
Covert
Unlike other Apollo pagers, that were developed and
Index marketed by Gold Apollo in Taiwan, the AR-924 was
developed by or on behalf of the Hun­ga­rian company
Glossary
BAC Consulting Kft. in Budapest. The devices were
sold however under the Gold Apollo brand, which had
Cameras been licenced to them. It is currently unclear where
they were made.
Recorders

Radio
Pagers were popular in the 1980s and 90s, but their function has mostly been superceeded by the SMS
Bugs facility of mobile phones. Nevertheless, they are still widely used, in particular by closed groups like the
emergency services. In some countries, paging services are still offered by com­mer­cial service providers.
Microphones Although paging services can be operated in several fre­quen­cy bands — notably 100-174, 400-470 and
929-932 MHz — the 150-174 band is the most popular one, as its signals penetrate concreate more easily.
Earpieces A pager will generally work in situations where a mobile phone has no coverage, 1 such as in basements. In
addition, a pager uses far less energy. It runs for weeks on a single battery charge, whereas a mobile
Optics phone must be recharged daily.
Concealments
Unlike a mobile phone, which allows two-way traffic, a pager is a one-way device. It can only receive and
Dead drops display messages sent through a (local) infrastructure. It cannot confirm the receipt of a message and,
hence, does not reveal its location. In addition, the infra­structure needed for a paging network, is usually
Tools separate from the mobile telephone network. in some cases though, a gateway allows messages to be sent
to a pager from a telephone or from a PC via the internet.
Stories

Software 1. Generally speaking, the higher the frequency, the more difficult it is for the signal to penetrate obstacles. As mobile phone
providers keep raising the frequency (to gain more bandwidth) it will be increasingly diffult to use 4G and 5G phones in a
Tracking basement, unless additional nodes are placed in its vicinity.

Radio
Features
PC The image below provides a quick overview of the controls and features of the AR-924 pager. The device is
Telex housed in a plastic enclosure with rounded corners, that measures 73 × 50 × 27 mm and weights 95 grams,
battery included. The device can run for 85 days on a single battery charge, which is why the battery takes
Telephones up about half the available space. It can be charged from the USB-C port of a PC or laptop, or with a
standard battery charger with a USB-C connector.
People

Agencies

Manufacturers

DONATE

Publications

Standards

For sale

Kits

Shop

News

Events

Wanted

Contact
A large part of the frontpanel is taken up by the transflective backlit 144 × 64 pixel liquid crystal display
About us (LCD). Four push-buttons are integrated with the lower edge of the enclosure. A buzzer is located to the
right of the display. Also present, but not visible, is an integrated vibrator.
Links

Features
Strong buzzer
Improved user interface
85 day battery life
USB-C battery charging in 2.5 hours
4-button operation
Mesage preview (scroll-down list)
Battery level indicator
Signal strength indicator
Stopwatch function
Backlit LCD display
 PC programmable and hand programmable

Battery
According to the website [13], the device had spring-loaded contacts for a replaceable Lithium battery,
which could be recharged in 2.5 hours, and power the device for no less than 85 days. It was probably
created especially for this purpose and is likely to have cointained the explosives.

According to the specifications, it measures 40 × 34 ×

18 mm and weights 35 g. It delivers 7.4V and has a
capacity of 300 mAh (2.2 Wh). The image on the right
shows the battery as it was offered on the Apollo
System HK website [15].

The battery has four gold-plated contacts that mate

with the four gold-plated spring contacts inside the
pager. The two outer contacts are the (-) and (+)
terminals of the battery. The remai­ning two contacts
are connected to the built-in Protection Circuit Module
(PCM). A PCM is nor­mal­ly used to prevent the battery
from over­charging, overheating and deep-
discharging. In this case it also triggered the
explosive charge.

The battery is large enough to house a high-capacity Li-ion battery, plus a detonator and an explosive
charge. The trick was in this case, to conceal the exposive charge in such a way that it would not be noticed
with an x-ray scan. This means that it was probably embedded within the layers of the battery, and that the
markers that are usually present to reveal plastic explosives like PETN and RDX (the ingrediants of
Semtex) during an x-ray scan, were deliberately omitted.

The battery is clearly different from the ones that were used by Gold Apollo. These were always regular AA-
size batteries. According to the text on the battery, it was MADE IN CHINA, but there is no sign of a
manufacturer name. To alleviate potential concerns about the uncommon battery, Mossad posted questions
about them in two online forums in January and February 2023. At least one of the questions received an
answer by a newly registered user in April 2023 [17]:

Sometimes there's no brand name on batteries. I know this product. It's got
a great datasheet and a great performance. Maybe you could ask the company
to send you these batteries with your own branding.

Also in September and October 2023, two (probably fake) online battery webshops came online, both
offering the LI-BT783 [14][16]. This was probably enough to satisfy Hezbollah. Both webshops have since
disappeared.

Hezbollah
The Lebanese terrorist organisation Hezbollah started using the old-school pagers around 2021, after the
suspcion arose that arch enemy Israel was not only able to intercept their communi­ca­tions, but could also
deter­mine their location and could potentially manipulate the devices. This is not unfounded, as much of the
software for (lawful) telephone interception is developed in Israel. Furthermore, Israeli companies like NSO
Group, have been in the news regularly for rigging mobile phones, including Apple's iPhone. Such parties
are generally linked to Israeli intelligence.

By using old technology, Hezbollah thought to have found a more secure way of communicating with its
operatives. This was amplified by Hezbollah leader Hassan Nasrallah, when in early 2023 he called upon
his followers to throw away their mobile phones and buy a pager instead. As a result, the organisation
needed more pagers, which were obtained through BAC Consulting.

The attack
On 17 September 2024 at 15.30 local time, a message was sent to all 5000 pagers of the Hez­bollah group.
The message appeared to come from Hezbollah leadership. Seconds later, approx. 4000 of the devices
exploded, killing several people and injuring thousands others. Among the victims were not only Hezbollah
operatives, but also innocent bystanders and even children.

In the hours after the attack, several picures of the

remains of exploded AR-924 devices were posted on
the internet, such as the one shown in the image on
the right. The images and the live footage from
several security cameras, confirm that the blasts were
not caused by overheated Lithium batteries, but by
explosive devices.

Several sources confirmed that explosives like RDX

and PETN had been found, both of which are the core
ingredients of Semtex. Only a small amount of RDX
or PETN is needed for a lethal explosion like the ones
in the published footage.

A day after the incident with the Apollo pagers – on the 18th – a similar thing happened to the handheld
two-way radios that were also used by Hezbollah [6]. In this case it reportedly involved the IC-V82 handheld
radio — a 20 year old model from the Japanese manufacturer ICOM. It works in the VHF radio band, and is
independent of the UHF paging network used by Hezbollah. Production of the IC-V82 was abandoned 10
years prior to the attack (2014), but counterfeit reproductions – presumably from China – were still widely
available from various outlets in Asia.
Covert operation
Although it is currently unknown who was responsible for the exploding devices, it is widely spe­cu­lated and
believed by experts, that an Israeli intelligence service was behind it — most likely the Mossad — in
cooperation with the Israeli Armed Forces (IAF). In a carefully planned and executed covert operation, they
had not only managed to infiltrate the supply chain, but had also been able to take over the manufacturing
of the devices. This enabled them to embed a small but powerful explosive device inside the existing
design, in such a way that it would not be noticed by ser­vice personnel. It is likely that they had also
manipulated the device's firmware, so that the explosive device would detonate upon receipt of a specially
crafted message.

➤ More about the covert operation

Mossad
In a remarkable interview with Lesley Stahl of the CBS News program '60 Minutes' on 22 Decem­ber 2024,
two anonymous Mossad officers admitted that Mossad was indeed behind the opera­tion [18]. The officers,
who wore masks and had their voices altered, give a detailed description of how the operations was
planned (10 years earlier) and executed. They confirmed that the pagers as well as the walkie-talkies had
been manufactured in Israel.

Crypto Museum comment — At present, we have our reservations about some of the claims made during the
interview. For example: Mossad officer 'Michael' claims that the explosive device was hidden inside the battery of
the ICOM IC-V82 handheld radio. We find this unlikely. The available photographic evidence confirm that the
explosion came from inside the radio itself and that the battery was blown off, not the other way around.

Manufacturer
Gold Apollo Taiwan
Gold Apollo is a Taiwanese company that manufactures a range of pagers, and sells them world­wide. The
AR-924 seems to be a ruggedised version of the AL-924 — at one time Apollo's most popular model that
has meanwhile been discontinued. Immediately after the incident with the exploding Hezbollah pagers,
Apollo's founder and president – Hsu Ching-kuang – told the press that his company had nothing to do with
the AR-924 model [4]. It was not manufactured by his company and had not been supplied by them either.
Instead, he claimed, the device was made the Hungarian firm BAC Consulting, to whom they had licenced
the design and company logo.

Apollo Systems Ltd. Taiwan, HongKong

Sales and marketing of the AR-924 were handled by a company in Hong Kong by the name of the Apollo
Systems HK Ltd. It (now defunct) website featured the AR-924 pager [13], along with an accompanying
video on YouTube. Apparently, this company was a subsidary of Applo Systems Ltd. in Taiwan, which was
headed by Theresa Wu, a former employee of Gold Apollo. Apollo Sys­tems Ltd. was reportedly a subsidary
of BAC Con­sul­ting in Hungary — the licence holder.

➤ See the (removed) AR-924 product page

➤ Watch the video

BAC Consulting Kft. Hungary

BAC Consulting Ktf., abbreviated BAC, was an Hungarian company, founded on 5 May 2022 and located in
Budapest (Hungary). According to Gold Apollo, they were involved in the production and sales of the AR-
924 pager — a rugged version of the AL-924 — for which it had purchased the rights to pager's design and
to the use of the company's name and its logo. A day after the incident, a representative of the Hungarian
president Viktor Orbán, told the press that the pagers had never actually been in Hungary, and that BAC
merely acted as an intermediary [7].

When reporters visited the company at its registered address [5], no BAC representative was available for
comment. At the address – a modest office building in the outskirts of Budapest – several other (unrelated)
companies are housed, and no one had seen the BAC director since the pager attacks on 17 September
[8]. According to several media, the company's registered owner has been placed under protection of the
Hungarian security services since the pager attacks [8].

It is possible, if not likely, that BAC and Apollo Systems Ltd. were shell companies, created specifically for
supplying the rigged pagers to Hezbollah. So far, it remains a mystery where the pagers were actually
made, but it is possible that they were manufactured by Apollo Systems in Hong Kong and supplied to
Hezbollah either directly or through yet another shell company.

Norta Global Ltd. Bulgaria

Two days after the attacks, on 19 September 2024, Bulgarian authorities started an investigation into a
company that they thought might have fascilitated the sale of the pagers to Hezbollah. Although the name
of that company wasn't revealed, Bulgarian media discovered it was Norta Global Ltd. in Sofia (Bulgaria)
[10][11]. This company, owned by Norwegian citizen Rinson Jose, was founded in April 2022, just weeks
before BAC Consulting was founded in Hungary. Like BAC, Norta has its headquarters in a local office
building along with 196 other (unrelated) companies. In a preliminary statement, the Bulgarian state security
service DANS said that it had not detected any shipments of the pagers on Bulgarian territory [12]. It was
revealed though, that Norta had payed a substancial amount of money to BAC Consulting, amounting to
more than EUR 1 million.

➤ More about exploding Hezbollah devices

Video
Introduction
This clip was found on the YouTube channel of Apollo
Systems HK in 2023. It shows the AR-924 pager in
operation and highlights its unique fea­tures, like the
improved user inter­face and the 85 day battery life.
Note that the name of the origi­nal manufacturer – Gold
Apollo – is used in the video, although in reality it was
Apollo Systems HK that was responsible for the
design and sales.

Source
YouTube, Apollo Systems HK

Date
13 December 2022

Block diagram
Below is the block diagram of the AR-924 pager. At the centre is the micro­controller (CPU) that forms the
heart of the device. It is driven by internally stored software (firm­ware) and has inter­faces to the controls,
display, vibrator, buzzer and radio modem. It also has a USB-C connection for altering the settings from a
regular PC, and to charge the internal Lithium-ion battery.

The battery is at the bottom. It was developed especially for this project and consists of a Li-ion battery with
a Protection Circuit Module (PCM), a detonator and an explosive charge. It is likely that the explosive
charge was embedded within the layers of the battery, so that it would not be noticed in an x-ray scan. The
detonator was probably integrated with the PCM.

Interior
As far as we know there are currently no photographs of the interior of te AR-924, apart from a few
fragments that were photographed immediately after the atacks. Below is an educated guess of the internal
construction of the device, based on an analysis of Raphael Wimmer on Mastodon [14], complemented by
our own observations and insights. The enclosure consists of two plastic case shells, held together by
screws that are inserted from the rear. The upper case shell contains the display window, the four knobs
and holes for the buzzer, the lanyard and the USB-C socket.
There are two printed circuit boards (PCBs). The upper one holds the microcontroller, the display, the
controls, the buzzer and the radio interface. The latter is probably fitted at the bottom of the PCB, below the
display. The lower board holds the USB-C socket and the battery contacts. It is constructed in such a way
that the battery contacts align with the spring contacts on the board. It is likely that the vibrator (a small
motor) is also fitted on the lower board.

Specifications
Device Pager
Purpose One-way closed-group wireless messaging
Model AR-924
Supplier BAC Consulting Kft., Hungary
Brand Gold Apollo
Supplier Apollo Systems Ltd.
Manufacturer ?
Year 2022-2024
Frequency 450-470 MHz
Spacing 25 kHz
Deviation 4.5 kHz
Rejection > 40dB
Protocol POCSAG
Data rate 512, 1200, 2400 baud
Sensitivity -110dBm (512 baud), -108dBm (1200 baud), -106dBm (2400 baud)
Capcodes 8, frame independent
Messages 30
Characters 100 per message
Display 146 × 64 pixels LCD 1
Language English
Battery LI-BT783 rechargeable Li-ion
Duration 85 days
Charging USB-C (2.5 hours)
Resistance IP67
Shock 1.5 m
Approval CE
Temperature -10°C to +50°C
Dimensions (HWD) 50 × 73 × 27 mm
Weight 95 g
 1. The horizontal resolution of 146 pixels is highly unlikely as it is not a multiple of 8. It is probably a typo and should be 144
pixels.

Documentation
A. Gold Apollo Rugged Pager AR924 (archived)
Product page on Apollo Systems Hong Kong website (meanwhile taken down).
Apollo Systems HK, 17 September 2024 (via WayBack Machine).

B. AL-924 Specifications
Apollo. Undated.

C. AL-914e User Manual

Apollo. Undated.

D. Apollo Pagers Programming Instructions

Apollo. Undated.

References
1. Wikipedia, Gold Apollo AR924
Visited 20 September 2024.

2. Wikipedia, 2024 Lebanon pager explosions

Visited 21 September 2024.

3. Pagers Explode Across Lebanon in Apparent Attack on Hezbollah

New York Times, 17 September 2024.

4. Gold Apollo says Budapest-based BAC produces model of pagers used in Lebanon blast
Reuters, Ben Blanchard. 18 September 2024.

5. Chamber of Commerce, company information

Visited 18 September 2024.

6. Exploding Hezbollah devices

Crypto Museum, 17 September 2024.

7. Orbán rep says Hezbollah exploding pagers were 'never' in Hungary

Politico, 19 September 2024.

8. The mystery woman whose company BAC Consulting is linked to exploding pagers
CNA, 21 September 2024.

9. CEO of company linked to Hezbollah pagers being guarded by Hungarian secret services
Justin Spike, Paolo Santalucia and Sarah el Deeb,
The Times of Israel/AP. 20 September 2024.

10. Bulgarije onderzoekt nu bedrijf gelinkt aan exploderende biepers

Bulgaria investigating company linked to exploding pagers (Dutch).
HLN, 19 September 2024.

11. Bulgaria to probe local firm's links to Lebanon pagers

Baha Breaking News, Christian Baha/RR. 19 September 2024.

12. Bulgaria opens probe into local company linked to Israeli-tampered pagers
The Cradle, News Desk. 19 September 2024.

13. Gold Apollo Rugged Pager AR924 (archived)

Product page on Apollo Systems Hong Kong website (meanwhile taken down).
Apollo Systems HK, 17 September 2024 (via WayBack Machine).

14. Raphael Wimmer, A small #OSINT thread about the AR-924 pager...
Mastodon, 26 September 2024.
➤ Similar thread on X (Twitter)

15. LI-BT783 Lithium-ion Battery pack

Apollo Systems HK, 17 September 2024 (Retrieved via WayBack Machine).

16. LI-BT783 Lithium-Ion Battery pack

Electronics Power, 18 July 2024 (Retrieved via WayBack Machine).

17. How Israel's bulky pager fooled Hezbollah

Maya Gebeily, James Pearson and David Gauthier-Villars.
Reuters, 16 October 2024.

18. Former agents from Israel's Mossad detail how they built and sold
explosive pagers to Hezbollah terrorists
Lesley Stahl, 22 December 2024.

19. The Real Reason Why Israel's Mossad Cooperated With

'60 Minutes' Tell-all on Hezbollah Pagers Attack
Yossi Melman, Haaretz, 24 December 2024.

Further information
Covert operation 'Pager Attacks'
Other covert radios

Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
© Crypto Museum. Last changed: Tuesday, 07 January 2025 - 09:14 CET.