Newsletters
Cybersecurity researchers have found that an Israeli ad tech company aggressively targeted users of Starlink’s satellite internet service, likely to spy on them, Reuters reported, citing six people familiar with the matter.
The researchers, from TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, determined that the Israeli company Discover-Tech ranked among the largest sources of digital ads displayed to customers of SpaceX’s Starlink and that the ads were probably used to pinpoint their locations or monitor them in other ways, the six people said.
Drawing on digital advertising data from TrendAI’s telemetry, the team found Discover-Tech had emerged as one of the top global bidders for ads aimed at Starlink users. It held the No. 1 spot on Starlink traffic in more than 100 countries, among them several where the service faces a ban or restrictions. Bidding describes the intricate auction system advertisers use to secure space in people’s browsers and apps.
Discover-Tech and its chief executive also stayed silent despite requests from Reuters over the past two weeks.
In an Oct. 15 report on the targeting of Starlink users, TrendAI withheld Discover-Tech’s name, attributing the activity to “an ad tech entity” it dubbed “Shadow-Earth-79.” The six sources identified Shadow-Earth-79 as TrendAI’s codename for Discover-Tech.
TrendAI did not directly answer questions about why its report left Shadow-Earth-79 unnamed. Instead, it said in a statement that its attribution approach seeks to lower the risk of errors and steer clear of “hype-driven labels” or “unstable actor names that can mislead defenders, distort risk prioritization, and trigger inappropriate response actions.”
Tracking Starlink users has turned into a cottage industry as governments worldwide struggle to control the proliferation of satellite internet terminals. The devices relay data through SpaceX-operated satellites instead of nationally regulated telecom companies, allowing them to bypass local internet restrictions, communicate in hostile areas and coordinate battlefield operations. The service has proved especially vital in Ukraine, whose military relies on it for front-line communications and guiding drone strikes.
In May, Israeli newspaper Haaretz and the website Intelligence Online each reported that Israeli-owned firms were offering clients methods to identify and track Starlink users. Haaretz said the exploitation of ad data appeared central to the process.
On the same day TrendAI released its findings, Canadian cyber watchdog Citizen Lab and New York ad tech firm Confiant publicly named Discover-Tech, accusing it of abusing the ad bidding process, a system that can leak information about internet users back to the bidder.
Over time, bidders can gather, collate and combine that leaked data with other information to unmask users, follow them across the web and, in some cases, pave the way for targeting them with surveillance software.
The two groups reported that the ads surfaced within dozens of sensitive networks tied to media outlets, governments and tech companies.
Following the investigations, Google, Comcast and other companies said they had dropped Discover-Tech from their ad platforms.
At least one major U.S. tech company and one international organization have recently opened internal probes into whether Discover-Tech’s ads targeted their staff, one of the six sources and a seventh person familiar with the matter said.
TrendAI’s report pointed to suspicious bidding patterns indicating Shadow-Earth-79 was running “targeting and tracking infrastructure rather than a commercial advertising operation.”
Beyond the “obvious skew” toward Starlink users, the report said Shadow-Earth-79 topped ad purchases in Syria, Libya, Yemen and South Sudan and ranked second in Afghanistan, even though “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero.” The entity also secured “an implausibly dominant share” of bids in countries such as Hungary, Israel, Egypt, Azerbaijan and Venezuela, it added.
The six people speaking to Reuters said TrendAI researchers felt certain Discover-Tech stood behind the suspicious bidding and considered naming it in the report. However, five of them said the researchers ultimately abandoned plans to publicly attribute the activity to the firm after TrendAI executives raised legal concerns.
Industry experts cited by Reuters the report say self-censorship is widespread across cybersecurity, especially when executives worry that revealing surveillance operations could provoke retribution.
Earlier this year, U.S. cybersecurity company Palo Alto removed explicit references to China from a report on a global cyberespionage campaign despite its researchers’ confidence that Beijing was behind the hacking, Reuters reported at the time..
Palo Alto’s findings had reportedly been watered down over fears that naming China would create problems for the company’s operations there, already under scrutiny after a Beijing directive told domestic companies not to use its products. Palo Alto said the lack of attribution in its report was not correlated with “procurement regulations in China” and called any suggestion otherwise “speculative and false.”
2 min read
Citizen Lab’s investigation also found that Discover-Tech bought ads embedded with spyware from Candiru, an Israeli firm the U.S. government blacklisted in 2021, infecting dozens of devices used by Al Jazeera staff and other companies in what researchers called the first known case of “zero-click” targeted advertising, Al Jazeera reported.
The Qatar-based network, whose in-house team first noticed unusual activity on journalists’ devices in 2024, condemned the attacks as an assault on press freedom and called for those responsible to be held accountable.
Set as preferred source
Set as preferred source
1 min read
