It is quite likely that there are passive devices that monitor cell phone channels without tricking them into connecting to a phony base station. These technically wouldn't be "stingrays". That is basically what the SIGINT satellites do. It could certainly be miniaturized for local area monitoring. In any case, the cell providers have basic details of what phones communicate with their towers. It doesn't seem like that avenue wasn't used in this case though.