Researchers from a digital defense firm found that an Israeli company specializing in advertising technology (ad-tech) was actively targeting users of the satellite internet service Starlink, likely for surveillance purposes. This was reported by six sources familiar with the situation.
Researchers at TrendAI, a division of Tokyo-based Trend Micro, concluded that the Israeli firm Discover-Tech was one of the largest sources of digital advertising shown to Starlink users from SpaceX. According to these six individuals, the advertising was likely used for geolocation or other forms of tracking.
The researchers used digital advertising data from TrendAI telemetry collected by security products. They established that Discover-Tech became one of the global leaders in bidding for advertising targeted at Starlink users and was a major participant in Starlink traffic auctions in over 100 countries, including territories where Starlink itself is banned or restricted. The auctions relate to a complex auction system through which advertisers gain placement in people's browsers and applications.
SpaceX did not respond to requests for comment. Discover-Tech and its CEO also did not respond to inquiries over the past two weeks.
TrendAI released a report on Starlink user targeting on October 15, but it did not name Discover-Tech. Instead, it indicated that the responsible party was an 'ad-tech entity' which it named 'Shadow-Earth-79.' The six sources clarified that Shadow-Earth-79 is TrendAI's codename for Discover-Tech.
TrendAI did not provide direct answers regarding why the name Shadow-Earth-79 was not mentioned in the report. In a statement, the company explained that its attribution approach aims to minimize the risk of errors and avoid 'hype-driven labels' or 'unstable actor names that could mislead defenders, distort risk prioritization, and provoke inappropriate countermeasures.'
Industry searching for tracking methods
The search for methods to track Starlink users has turned into a kind of makeshift industry, as governments worldwide attempt to control the spread of satellite internet terminals. Since these terminals transmit data via satellites managed by SpaceX, rather than through nationally regulated telecommunications companies, they are capable of bypassing local internet restrictions, communicating in hostile zones, or coordinating actions on battlefields. Starlink has become an especially important resource in Ukraine, whose army relies on this service for frontline communication and directing drone strikes.
In May, the Israeli newspaper Haaretz and the website Intelligence Online independently reported that Israeli enterprises were offering clients ways to identify and track Starlink users. Haaretz noted that the use of advertising data apparently played a key role in this process.
On the same day TrendAI published its report on Shadow-Earth-79, the Canadian cyber oversight body Citizen Lab and the New York ad-tech firm Confiant named Discover-Tech. Both groups stated that the Israeli company was abusing the advertising auction process, which can reveal internet user data to the auction participant. Over time, auction participants can collect these data leaks, aggregate them, and combine them with other information to de-anonymize users, track them across the network, and, in some cases, profile them for tracking via surveillance software.
Citizen Lab and Confiant reported that advertisements were displayed within dozens of private networks belonging to media organizations, governments, and technology companies. In response to investigations, Google, Comcast, and other companies stated that they had removed Discover-Tech from their advertising platforms.
According to one of the six sources and another person familiar with the matter, at least one large American technology company and one international organization have recently begun internal reviews regarding whether their employees were targeted by Discover-Tech advertising.
The TrendAI report referenced suspicious bidding patterns suggesting that Shadow-Earth-79 was running a 'targeting and tracking infrastructure, not a commercial advertising operation.' In addition to a 'clear bias' in purchasing advertising aimed at Starlink users, the report indicated that Shadow-Earth-79 was the largest advertiser in Syria, Libya, Yemen, and South Sudan, and the second largest in Afghanistan, despite 'the demand for legitimate Western advertising in sanctioned or active conflict zones being virtually zero.' It was noted that this structure received an 'improbably dominant share' of bids in several countries, including Hungary, Israel, Egypt, Azerbaijan, and Venezuela.
The six individuals reported that TrendAI researchers were convinced of Discover-Tech's involvement in the suspicious bidding and discussed the possibility of naming the company in the report. However, they abandoned this idea after TrendAI executives raised legal concerns.
Self-censorship
Security industry experts note that self-censorship is common in cybersecurity, especially when executives fear that disclosing surveillance operations could provoke countermeasures.
Earlier this year, the American cybersecurity company Palo Alto Networks excluded explicit mentions of China from a report on a global cyber espionage campaign, even though its researchers were confident that the hacking could be linked to Beijing, as Reuters reported at the time. Reuters reported that the report was softened due to fears that naming China would create problems for Palo Alto's operations there, which were already under scrutiny following a Beijing directive ordering domestic companies not to use its products. Palo Alto stated that the lack of attribution in its report does not correlate with 'Chinese procurement regulatory requirements,' and that any other assumption is 'speculative and false.'
>