Raphael Arakelian on Operation Grim Beeper

On this episode of the Nexus Podcast, Accenture OT/IoT Cybersecurity Manager Raphael Arakelian shares his research into Operation Grim Beeper, a two-day attack in 2024 in the Middle East where explosives were introduced into pagers and walkie-talkies favored by Hezbollah, injuring more than 1500 and killing dozens.

Arakelian spent extensive time examining almost every aspect of this newfangled Trojan horse attack from the actual development of the explosives within the communication devices, to the Israeli's mapping and understanding of the Hezbollah supply chain in order to become part of their procurement network and introduce the tampered devices in order ensure they reached their targets. Finally, he studied how the devices were triggered across geographically large areas. He also believes there are lessons that can be applied to operational technology realms, in addition to supply chain security.

"This attack definitely got a lot of attention worldwide and ...one of the key underlying themes or reactions was still one of awe. A lot of people said, including myself when I first heard and saw it, it's like this could be straight from a James Bond movie," Arakelian said. "I don't know where such an operation happens at such a scale and against an organization that has a lot of, let's say, they have their own security mechanisms and also be so successful at the same time. So the complexity, the success, the nature of it is really what drove me to understand this attack and try to break it down from my standpoint and see how it applies to OT environments and the ICS ecosystem."

Arakelian characterizes Operation Grim Beeper as highly complex, comparable to other operations where ammunition was booby-trapped during the Vietnam War, and of course Greek story of the Trojan horse and its importance in the history of warfare.

"Of course, that story is known as a myth or legend, but when I look at it, when I look at everything at this 10,000-foot view, it's Operation Green Beeper, highly complex, very sophisticated," Arakelian said. "A supply chain compromise was involved. It was crafted at the design phase. So it wasn't just a simple insertion somewhere in the supply chain. So all those elements together really put it in a high-percentile quarter."

Arakelian said these types of attack are applicable to any type of electronic device, including OT assets.

"Modern electronics rely on chips. When chips or integrated circuits are involved, there are modifications that could be done in terms of the logic. The chip itself can be modified and new logic introduced," he explained. "There are a few angles to be able to come up with a hardware Trojan. It can apply to peripheral devices, controllers, sensors, CPUs, charging cable, anything."