Israeli firm accused of using online ads to track Starlink users worldwide
Six people familiar with TrendAI's research said the cybersecurity firm linked Discover-Tech to extensive ad targeting of Starlink users, including in countries where the service is banned or restricted. The findings follow separate investigations alleging that the company used digital advertising to facilitate surveillance.
Researchers at a digital defense firm recently found that an Israeli ad tech company was heavily targeting users of Starlink's satellite internet service in what was likely an effort to spy on them, according to six people familiar with the matter.
Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, concluded that the Israeli company Discover-Tech was one of the largest sources of digital ads shown to users of SpaceX's Starlink service. The ads were likely being used to geolocate or otherwise surveil them, the six people said.
Drawing on digital advertising data collected through TrendAI's telemetry, the researchers found that Discover-Tech had become one of the world's leading bidders for ads targeting Starlink users. It was the No. 1 bidder on Starlink traffic in more than 100 countries, including several where the service itself was banned or restricted. Bidding refers to the complex auction system through which advertisers secure space in people's browsers and apps.
SpaceX did not respond to requests for comment. Discover-Tech and its chief executive also did not respond to requests for comment over the past two weeks.
TrendAI published a report on October 15 detailing the targeting of Starlink users, but it did not name Discover-Tech. Instead, it identified the party responsible as an “ad tech entity” and assigned it the codename “Shadow-Earth-79.” The six sources said that Shadow-Earth-79 was TrendAI's codename for Discover-Tech.
TrendAI did not directly address questions about why the report did not identify Shadow-Earth-79 by name. In a statement, the company said its approach to attribution was designed to reduce the risk of mistakes and avoid “hype-driven labels” or “unstable actor names that can mislead defenders, distort risk prioritization, and trigger inappropriate response actions.”
Finding ways to track Starlink users has become a growing industry as governments around the world seek to control the spread of satellite internet terminals. Because the terminals route data through SpaceX-operated satellites rather than nationally regulated telecommunications providers, they can circumvent local internet restrictions, enable communications in hostile areas and help coordinate operations on battlefields.
Starlink has become particularly important in Ukraine, where the military relies on the service for frontline communications and directing drone strikes.
In May, Israeli newspaper Haaretz and the website Intelligence Online separately reported that Israeli-owned businesses were pitching clients on ways to identify and track Starlink users. Haaretz said exploiting advertising data appeared to play a key role in the process. Intelligence Online also reported on the activity.
The same day TrendAI published its report on Shadow-Earth-79, Canadian cybersecurity watchdog Citizen Lab and New York-based advertising technology firm Confiant identified Discover-Tech by name.
Both groups said the Israeli company had abused the ad-bidding process, which can expose information about internet users to bidders.
Over time, bidders can collect and combine the leaked data with other information to de-anonymize users, track their activity across the web and, in some cases, target them with surveillance software.
Citizen Lab and Confiant said the ads had appeared inside dozens of sensitive networks belonging to media organizations, governments and technology companies.
Following the investigations, Google, Comcast and other companies said they had removed Discover-Tech from their advertising platforms.
At least one major U.S. technology company and one international organization recently launched internal inquiries into whether Discover-Tech's ads had targeted their employees, according to one of the six people and a seventh person familiar with the matter.
TrendAI's report cited suspicious bidding patterns that suggested Shadow-Earth-79 was operating “targeting and tracking infrastructure rather than a commercial advertising operation.”
Alongside what it described as an “obvious skew” toward ads targeting Starlink users, the report said Shadow-Earth-79 was the top buyer of ads in Syria, Libya, Yemen and South Sudan, and the second-largest buyer in Afghanistan. The report said “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero.”
It also said the entity won “an implausibly dominant share” of bids in several countries, including Hungary, Israel, Egypt, Azerbaijan and Venezuela.
TrendAI researchers were convinced Discover-Tech was behind the suspicious bidding activity and discussed naming the company in the report, according to the six people familiar with the matter. But they ultimately abandoned the idea of publicly attributing the activity to a named company after TrendAI executives raised legal concerns, five of the sources said.
Self-censorship is common in the cybersecurity industry, particularly when executives fear that exposing surveillance operations could provoke retaliation, industry experts say.
Earlier this year, U.S. cybersecurity company Palo Alto Networks removed explicit references to China from a report on a global cyberespionage campaign, even though its researchers were confident the hacking could be attributed to Beijing, Reuters reported. Reuters reported that the report was toned down over concerns that naming China could create problems for Palo Alto's operations there, which were already under scrutiny after Beijing directed domestic companies not to use its products.
Palo Alto said the lack of attribution in its report was not related to “procurement regulations in China” and that any suggestion otherwise was “speculative and false.”
