SavedAdd your journal

Journals / Güvenlik Stratejileri Dergisi / 2025 / Cilt: 21 Sayı: 52

A New Perspective and Model Proposal for Cyber Threat Intelligence after Pager Attacks

Çağrı Cihazı Saldırıları Sonrası Siber Tehdit İstihbaratı için Yeni Bir Perspektif ve Model Önerisi

Tuncay Doğantuna(GAZİ ÜNİVERSİTESİ, FEN BİLİMLERİ ENSTİTÜSÜ, BİLGİ GÜVENLİĞİ MÜHENDİSLİĞİ ANABİLİM DALI (DİSİPLİNLERARASI), BİLGİ GÜVENLİĞİ MÜHENDİSLİĞİ (DR))0000-0003-4135-7690
Onur Ceran(GAZİ ÜNİVERSİTESİ, UYGULAMALI BİLİMLER FAKÜLTESİ)0000-0003-2147-0506
Pages
415–447
Publication Date
2025-12-19
🏛️Bibliographic metadata and full text access for this article are provided via DergiPark.
DergiPark Record ↗
✨

AI Summary & Key Takeaways

AI Insight
⚡ TL;DR(Too Long; Didn't Read)

Integrating RF variable vectors into CTI frameworks, the proposed model may offer a more comprehensive approach to detect and prevent hybrid threats, reshaping threat intelligence and defense policy in the digital age.

📌 3 Key Takeaways

🎯
Objective & Hypothesis:This study explores the September 2024 pager attacks on Hezbollah as a case study to propose an expanded model for Cyber Threat Intelligence (CTI) within the framework of hybrid warfare.
📊
Key Findings & Data:Mitigation strategies include RF anomaly detection, secure communication protocols, and integrated SIGINT incident response.
💡
Conclusion & Impact:Integrating RF variable vectors into CTI frameworks, the proposed model may offer a more comprehensive approach to detect and prevent hybrid threats, reshaping threat intelligence and defense policy in the digital age.
🔬Design:Modeling & Simulation
📍Scope:2024 Verileri
⚙️Variables:Elektronik Harp · Siber Tehdit İstihbaratı · Sinyal İstihbaratı

Abstract

This study explores the September 2024 pager attacks on Hezbollah as a case study to propose an expanded model for Cyber Threat Intelligence (CTI) within the framework of hybrid warfare. Attributed to a highly coordinated Israeli operation, the attack involved not only cyber elements but also Electronic Warfare (EW), Signals Intelligence (SIGINT), and manipulated supply chains. The incident marked by the synchronized detonation of thousands of pagers and radios exemplifies the integration of kinetic and cyber capabilities, challenging conventional threat intelligence models. The research critiques the current limitations of the MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework, especially its inability to adequately capture Radio Frequency (RF)-based and analog-targeted attacks. In response, it proposes two new techniques: “Spectrum-Based Signal Injection” and “RF Message Injection & Manipulation”, aiming to better represent EW and SIGINT-driven threats. Mitigation strategies include RF anomaly detection, secure communication protocols, and integrated SIGINT incident response. The study investigates the strategic use of low-tech device vulnerabilities and supply chain compromises in modern conflicts, highlighting the blurred boundaries between physical and digital warfare. Integrating RF variable vectors into CTI frameworks, the proposed model may offer a more comprehensive approach to detect and prevent hybrid threats, reshaping threat intelligence and defense policy in the digital age.

Özet

Bu çalışma, hibrit savaş çerçevesinde Siber Tehdit İstihbaratı (CTI) için genişletilmiş bir model önermek amacıyla, Eylül 2024'te Hizbullah'a yapılan çağrı cihazı saldırılarını bir vaka çalışması olarak incelemektedir. Son derece koordineli bir İsrail operasyonuna atfedilen saldırı, yalnızca siber unsurları değil, aynı zamanda Elektronik Harp (EH), Sinyal İstihbaratı (SIGINT) ve manipüle edilmiş tedarik zincirlerini de içermektedir. Binlerce çağrı cihazı ve telsizin senkronize bir şekilde patlatılmasıyla göze çarpan olay, kinetik ve siber yeteneklerin entegrasyonuna örnek teşkil ederek geleneksel tehdit istihbaratı modellerine meydan okumaktadır. Araştırma, MITRE ATT&CK (Rakip Taktikler, Teknikler ve Genel Bilgi) çerçevesinin mevcut sınırlamalarını, özellikle Radyo Frekansı (RF) tabanlı ve analog hedefli saldırıları yeterli şekilde yakalayamamasını eleştirmektedir. Buna karşılık, EH ve SIGINT kaynaklı tehditleri daha iyi temsil etmeyi amaçlayan iki yeni teknik önermektedir: “Spektrum Tabanlı Sinyal Enjeksiyonu” ve “RF Mesaj Enjeksiyonu ve Manipülasyonu”. İyileştirme stratejileri, RF anomali tespiti, güvenli haberleşme protokolleri ve entegre SIGINT olay müdahalesini içerir. Çalışma, modern çatışmalarda düşük teknolojili cihazların güvenlik açıklarının ve tedarik zinciri zafiyetlerinin stratejik kullanımını vurgulayarak fiziksel ve dijital savaş arasındaki bulanık sınırları inceler. RF değişkenli vektörleri CTI çerçevelerine entegre eden önerilen model, hibrit tehditleri tespit ve önlemek için daha kapsamlı bir yaklaşım sunabilir, dijital çağda tehdit istihbaratını ve savunma politikasını yeniden şekillendirir.

🔖

Cite This Article

Doğantuna, T., Ceran, O., *, T. D. (2025). A New Perspective and Model Proposal for Cyber Threat Intelligence after Pager Attacks. Güvenlik Stratejileri Dergisi, Cilt: 21 Sayı: 52, 415–447. https://doi.org/10.17752/guvenlikstrtj.1695757

📄 Full Text PDF Viewer

📄

PDF görüntüleyici hazırlanıyor...

References (72)

  1. AHN Gwanghyun, JANG Jisoo, CHOI Seho ve SHIN Dongkyoo (2024). “Research on Improving Cyber Resilience by Integrating the Zero Trust Security Model with the MITRE ATT&CK Matrix”, IEEE Access, 12, 89291–89309.
  2. AKDEMİR Merve Ş. (2022). “Egemenlik ve Evrensel Yargı Yetkisi İlişkisinin Uluslararası Ceza Hukuku Boyutu”, Anadolu Üniversitesi Hukuk Fakültesi Dergisi, 8:2, 261-275.
  3. AL-KHAWAJA Ali ve SADKHAN Sattar B. (2021). “Intelligence and Electronic Warfare: Challenges and Future Trends”, 2021 7th International Conference on Contemporary Information Technology and Mathematics (ICCITM), IEEE, 118-123.
  4. AL-SADA, Bader, SADIGHIAN, Alireza ve OLIGERI, Gabriele (2023). “Analysis and Characterization of Cyber Threats Leveraging the MITRE ATT&CK Database”, IEEE Access, 12, 1217–1234. A
  5. PPLEGATE Scott D. (2009). “Social engineering: Hacking the wetware!”, Information Security Journal: A Global Perspective, 18:1, 40-46.
  6. BACK Tobias B. (2025). “Weaponising ‘apparently harmless portable objects’: emerging categorisations of trust and risk in post ‘pager attacks’ Lebanon”, Small Wars & Insurgencies, 36:6, 1025-1048.
  7. BELLABY Ross W. (2016). “Justifying Cyber-Intelligence?”, Journal of Military Ethics, 15:4, 299–319.
  8. BORUM Randy, FELKER John, KERN Sean, DENNESEN Kristen ve FEYES Tonya (2015). “Strategic Cyber Intelligence”, Information & Computer Security, 23:3, 317–332.
  9. BRATKO Artem, ZAHARCHUK Denys ve ZOLKA Valentyn (2021). “Hybrid Warfare–A Threat to the National Security of the State”, Revista de Estudios en Seguridad Internacional, 7:1, 147–160.
  10. CALISKAN Murat (2019). “Hybrid warfare and strategic theory”, Horizon Insights, 6.
  11. CHRISTIANSON David L. (2019). “Signals intelligence”, Geral W. Hopple ve Bruce W. Watson (ed.), The Military Intelligence Community, New York, Routledge, 39-54.
  12. COHEN Amichai ve SHANY Yuval (2024). “Well, it depends: Explosive pagers attack revisited”, Articles of War, https://lieber.westpoint.edu/well-it-depends-explosive-pagers-attack-revisited/, erişim 24.09.2024.
  13. FLORIDI Luciano (2010). The Cambridge Handbook of Information and Computer Ethics, Cambridge University Press.
  14. GHERNOUTI-HÉLIE Solange (2010). “A national strategy for an effective cybersecurity approach and culture”, 2010 International Conference on Availability, Reliability and Security, IEEE, 370-373.
  15. GILL Peter (2012). “Intelligence, Threat, Risk and the Challenge of Oversight”, Intelligence and National Security, 27:2, 206-222.
  16. GÜNDOĞDU Serkan (2023). “Uluslararası Politikada Bir Etki Aracı Olarak Siber Güvenlik ve Türkiye’nin Siber Güvenlik Politikası Uygulaması: Ulusal Siber Olaylara Müdahale Merkezi (USOM)”, Fırat Üniversitesi Sosyal Bilimler Dergisi, 33:3, 1325-1337.
  17. GÜNEŞ Burak (2021). “Egemenlik ve İnsancıl Müdahale: Çelişkili Bir Kuram Olarak Uluslararası Hukuk”, Güvenlik Bilimleri Dergisi, 10:1, 31-58.
  18. HAMMI Badis, ZEADALLY Sherali ve NEBHEN Jamel (2023). “Security threats, countermeasures, and challenges of digital supply chains”, ACM Computing Surveys, 55:14s, 1-40. H
  19. OFFMAN Frank G. (2007). “Conflict in the 21st century: The rise of hybrid wars”, Arlington: Potomac Institute for Policy Studies.
  20. JO Yonghyun, CHOI Oongjae, YOU Jiwoon, CHA Youngkyun ve LEE Dong H., (2022). “Cyberattack Models for Ship Equipment Based on the MITRE ATT&CK Framework”, Sensors, 22:5, 1860.
  21. KANJ BONHARD S., VILLALTA Pau G., ROSES Oriol, PEGUEROLES Josep (2025). “A Review of Tactics, Techniques, and Procedures (TTPs) of MITRE Framework for Business Email Compromise (BEC) Attacks”, IEEE Access.
  22. KARAKUŞ Cahit (2013). Kritik Alt Yapılara Siber Saldırı, Yüksek Lisans Tezi, İstanbul Kültür Üniversitesi.
  23. LASICA Daniel T. (2009). “Strategic implications of hybrid war: A theory of victory”, School of Advanced Military Studies, United States Army Command and General Staff College. LAVAZZA Andrea ve FARINA Mirko (2024). “The Costs and Perils of Weaponizing Consumer Technologies (The 2024 Pager and Walkie-Talkie Explosions in Lebanon and Syria)”, IEEE Technology and Society Magazine.
  24. LIAROPOULOS Andrew (2011). “War and Ethics in Cyberspace”, Leading Issues in Information Warfare and Security Research, 1:121.
  25. MAHAT Shobendra S. (2025). “Vulnerabilities of the Communication System to an Electromagnetic (EM) Attack, Threat Assessment and Mitigation”, The Shivapuri Journal, 26:1, 134-144.
  26. MARSHALL Kimball P. (1999). “Has Technology Introduced New Ethical Problems?”, Journal of Business Ethics, 19, 81-90.
  27. MARSZAŁEK-KOTZUR Izabela (2022). “Ethical Perspective of the Development and Use of Modern Military Technologies”, Scientific Papers of Silesian University of Technology, Organization & Management/Zeszyty Naukowe Politechniki Slaskiej, Seria Organizacji i Zarzadzanie, 165.
  28. MASSACCI Fabio (2025). “Exploding Pagers and the Birth of State Cyberterrorism”, IEEE Security & Privacy, 23:01, 4-6.
  29. NAIK Nitin, JENKINS Paul, GRACE Paul ve SONG Jingping (2022). “Comparing Attack Models for IT Systems: Lockheed Martin’s Cyber Kill Chain, MITRE ATT&CK Framework and Diamond Model”, 2022 IEEE International Symposium on Systems Engineering (ISSE), IEEE, 1–7.
  30. NYE Joseph S. (2010). Cyber Power, Cambridge: Harvard Kennedy School, Belfer Center for Science and International Affairs.
  31. PEFFERS Ken, TUUNANEN Tuure, ROTHENBERGER Marcus A. ve CHATTERJEE Samir (2007). “A Design Science Research Methodology for Information Systems Research”, Journal of Management Information Systems, 24:3, 45–77.
  32. PELL Robert, MOSCHOYIANNIS Sotiris, PANAOUSIS Emmanouil ve HEARTFIELD Ryan (2021). “Towards Dynamic Threat Modelling in 5G Core Networks Based on MITRE ATT&CK”, arXiv preprint arXiv:2108.11206, https://arxiv.org/abs/2108.11206.
  33. REICHBORN-KJENNERUD Erik ve CULLEN Patrick (2022). “What is hybrid warfare?”, Norwegian Institute for International Affairs (NUPI).
  34. RID Thomas (2013). “Cyberwar and peace: Hacking can reduce real-world violence”, Foreign Affairs, 92:6, 77-87.
  35. SAGAN Scott D. (2016). “Ethics, technology & war”, Daedalus, 145:4, 6-11.
  36. SARKER Pantha Protim, DAS Upoma, VARSHNEY Nitin, SHI Shang, KULKARNI Akshay, FARAHMANDI Farimah ve TEHRANIPOOR Mark (2025). “When Everyday Devices Become Weapons: A Closer Look at the Pager and Walkie-talkie Attacks”, arXiv preprint arXiv:2501.17405.
  37. SCHLEHER D. Curtis (1999). Electronic Warfare in the Information Age, Norwood, MA: Artech House, Inc., 1999.
  38. SCOTT Len (2019). “Secret Intelligence, Covert Action and Clandestine Diplomacy”, Christopher Andrew, Richard J. Aldrich ve Wesley K. Wark (ed.), Secret Intelligence, London, Routledge, 526–544.
  39. SHENG Chuan, MA Wanlun, HAN Qing-Long, ZHOU Wei, ZHU Xiaogang ve WEN Sheng (2024). “Pager Explosion: Cybersecurity Insights and Afterthoughts”, IEEE/CAA Journal of Automatica Sinica, 11:12, 2359-2362.
  40. SKRODELIS Heinrihs K. ve ROMANOVS Andrejs (2021). “Cyber-Physical Risk Security Framework Development in Digital Supply Chains”, 62nd International Scientific Conference on Information Technology and Management Science of Riga Technical University (ITMS), IEEE, 1–5.
  41. STROM Blake E., APPLEBAUM Andy, MILLER Doug P., NICKELS Kathryn C., PENNINGTON Adam G. ve THOMAS Cody B. (2018). “MITRE ATT&CK: Design and Philosophy”, Technical Report, McLean, VA: The MITRE Corporation.
  42. SUN Nan, DING Ming, JIANG Jiaojiao, XU Weikang, MO Xiaxing, TAI Yonghang ve ZHANG Jun (2023). “Cyber Threat Intelligence Mining for Proactive Cybersecurity Defense: A Survey and New Perspectives”, IEEE Communications Surveys & Tutorials, 25:3, 1748-1774.
  43. SVETOKA Sanda (2016). “Social media as a tool of hybrid warfare”, NATO Strategic Communications Centre of Excellence.
  44. UMBRELLO Steven, TORRES Phil ve DE BELLIS Angelo F. (2020). “The future of war: Could lethal autonomous weapons make conflict more ethical?”, Ai & Society, 35:1, 273-282.
  45. URBINI Ignacio M. G., VENOSA Paula, BAZÂN Patricia ve DEL RIO Nicolâs (2022). “Distributed Cybersecurity Strategy, applying the Intelligence Operations Theory”, 2022 17th Iberian Conference on Information Systems and Technologies (CISTI), IEEE, 1-6.
  46. WARNER Michael (2019). “A matter of trust: Covert action reconsidered”, Studies in Intelligence, 63:4, 33–41.
  47. ARSLAN İkbal Muhammet (2024). “BM: Lübnan ve Suriye’de Eş Zamanlı Çağrı Cihazı Patlamaları Şok Edici”, Anadolu Ajansı (AA), https://www.aa.com.tr/tr/dunya/bm-lubnan-ve-suriyede-es-zamanlicagri- cihazi-patlamalari-sok-edici/3333807, erişim 07.01.2025.
  48. BIÇAKÇI Salih (2024). “Lübnan’da Patlayan Çağrı Cihazları: Elektronik Harp, Siber Sabotaj ve Kötülüğün Sıradanlığı”, Fikir Turu, https://fikirturu.com/jeo-politika/lubnanda-patlayan-cagri-cihazlari/, erişim 24.09.2024.
  49. Ekonomi ve Dış Politika Araştırma Merkezi (2016). “Nükleer Tesislerin Siber Güvenliğine Giriş”, EDAM, https://edam.org.tr/siber-politikalar-ve-dijital-demokrasi/nukleer-tesislerin-siber-guvenligine-giris, erişim 01.02.2025.
  50. GEBEILY Maya, PEARSON James ve GAUTHIER-VILLARS David (2025). “How Israel’s bulky pager fooled Hezbollah”, Reuters, https://www.reuters.com/graphics/ISRAEL-PALESTINIANS/ HEZBOLLAH-PAGERS/mopawkkwjpa/, erişim 17.10.2024.
  51. IEEE Spectrum (2024). “The Real Story of Stuxnet”, https://spectrum.ieee.org/the-real-story-of-stuxnet, erişim 01.02.2025. ISB Staff Reporter (2024). “Hezbollah Pager Attack: A Wake-up Call to Tech Manufacturers to Secure their Supply Chains?”, Information Security Buzz, https://informationsecuritybuzz.com/hezbollah-pagerattack- a-wake-up-call/, erişim 20.10.2024.
  52. LACY Mark (2024). “Lebanon Pager Attacks: The Weaponisation of Everything has Begun”, The Conversation, https://theconversation.com/lebanon-pager-attacks-the-weaponisation-of-everythinghas- begun-239423, erişim 23.10.2024.
  53. LIMA Marcelo (2024). “Israeli Pager Attack: Cybersecurity Lessons”, LinkedIn, https://www.linkedin.com/ pulse/israeli-pager-attack-cybersecurity-lessons-security-marcelo-kcjxf, erişim 21.10.2024.
  54. LINKEDIN,https://www.linkedin.com/search/results/all/?keywords=%23pagerexplosion&origin=HASH_ TAG_FROM_FEED&sid=Q3u, erişim 20.09.2024.
  55. MEDIUM, https://medium.com/search?q=%23pagerexplosion, erişim 20.09.2024. MITRE, “MITRE ATT&CK Groups”, https://attack.mitre.org/groups/, erişim 5.01.2025.
  56. MITRE, “MITRE Enterprise Matrix”, https://attack.mitre.org/matrices/enterprise/, erişim 20.01.2025.
  57. MITRE, “T0862: Remote Access Software”, MITRE ATT&CK, https://attack.mitre.org/techniques/T0862/, erişim 21.01.2025.
  58. MITRE, “MITRE ATT&CK Tactics”, https://attack.mitre.org/tactics/, erişim 22.01.2025.
  59. MITRE, “T1583: Acquire Infrastructure”, MITRE ATT&CK, https://attack.mitre.org/techniques/T1583/, erişim 22.01.2025.
  60. MITRE, “T1199: Trusted Relationship”, MITRE ATT&CK, https://attack.mitre.org/techniques/T1199/, erişim 23.01.2025.
  61. NIST, “Tactics, Techniques, and Procedures”, National Institute of Standards and Technology, https://csrc.nist.gov/ glossary/term/tactics_techniques_and_procedures, erişim 22.04.2025.
  62. PARIENTE Nissim (2024). “The Machine Identity Attack Surface – MITRE ATT&CK Framework Redefined”, Token Security, https://www.token.security/blog/the-machine-identity-attack-surface--- mitre-attack-framework-redefined, erişim 20.01.2025.
  63. PICUS Security (2024). “What is Advanced Persistent Threat (APT)?”, Picus Security, https://www.picussecurity.com/ resource/glossary/what-is-advanced-persistent-threat-apt, erişim 05.05. 2025.
  64. PYTLAK Allison, SIEBENS Siebens ve LAD Shreya (2024). “Old Tactics, New Targets: Unraveling Lebanon’s Pager Attacks”, Stimson Center, https://www.stimson.org/2024/old-tactics-new-targets, erişim 24.10.2024.
  65. RAMAKRISHNA Sudhakar (2021). “New Findings from Our Investigation of SUNBURST”, SolarWinds Blog, https://www.solarwinds.com/blog/new-findings-from-our-investigation-of-sunburst, erişim 06.05.2025. R
  66. EDDIT (2024). “Israel planted explosives in 5,000 Hezbollah pagers, say sources“, https://www.reddit. com/r/geopolitics/comments/1fjnx3y/israel_planted_explosives_in_5000_hezbollah/, erişim 19.09.2024.
  67. SEREN Merve (2024). “İsrail’in Yeni İstihbarat Operasyonu: Pager ve Walkie-Talkie saldırıları”, Fikir Turu, https://fikirturu.com/jeo-politika/israilin-yeni-istihbarat-operasyonu/, erişim 25.09.2024.
  68. SİNCAR Halil İbrahim, BODRUK Bestami (2024). “Turkish Minister Underscores Need for National Technology after Pager Explosions in Lebanon”, Anadolu Ajansı (AA), https://www.aa.com.tr/ en/turkiye/turkish-minister-underscores-need-for-national-technology-after-pager-explosions-inlebanon/ 3334019, erişim 29.05.2025.
  69. SINGH Inder (2024). “New Paradigm in Cyber Warfare: Strategic Pager Attack on Hezbollah”, Medium, https://inderbarara.medium.com/new-paradigm-in-cyber-warfare-strategic-pager-attack-onhezbollah- d100247bd9ec, erişim 22.10.2024.
  70. STAHL Lesley (2025) “ Israel’s spy agency, Mossad, spent years orchestrating Hezbollah walkie-talkie, pager plots”, CBS News, https://www.cbsnews.com/news/israeli-mossad-pager-walkie-talkie-hezbollahplot- 60-minutes/, erişim 06.01.2025.
  71. STAHL Lesley (2025). “Former Mossad Agents Detail Explosive Pagers, Hezbollah Terrorists Plot – 60 Minutes Transcript”, CBS News, https://www.cbsnews.com/news/israel-former-mossad-agentsdetail- explosive-pagers-hezbollah-terrorists-plot-60-minutes-transcript/, erişim 09.06.2025.
  72. TWITTER (X). https://x.com/hashtag/pagerexplosions?src=hashtag_click, erişim 19.09.2024.