Israeli Ad-Tech Firm Accused of Targeting Starlink Users in Suspected Surveillance Campaign

An Israeli advertising technology company, Discover-Tech, has been accused of extensively targeting users of SpaceX’s Starlink satellite internet service in what may have been an attempt to identify their locations or conduct surveillance on them, according to a Reuters report.

Researchers at TrendAI, a unit of Japanese cybersecurity company Trend Micro, found that Discover-Tech was among the largest buyers of digital advertisements displayed to Starlink users. Six people familiar with the matter told Reuters that the activity may have been intended to locate users or monitor their online activity.

The researchers used data from TrendAI’s threat-monitoring system to examine digital advertising activity. Their findings indicated that Discover-Tech had become one of the world’s largest buyers of targeted advertisements reaching Starlink-related traffic, ranking first in more than 100 countries, including several where Starlink is banned or restricted.

TrendAI published a report on October 15 describing the targeting activity but did not publicly identify Discover-Tech. Instead, it referred to the suspected operator by the codename “Shadow-Earth-79,” describing it only as an advertising technology group. Six sources familiar with the investigation told Reuters that the codename referred to Discover-Tech.

In a statement, TrendAI said its approach to attributing suspicious activity to specific actors was designed to reduce the risk of misidentification and avoid sensational labeling that could mislead cybersecurity defenders, distort risk prioritization and trigger disproportionate responses.

Tracking Starlink Users Becomes a Growing Concern

Efforts to track Starlink users have become increasingly widespread as governments seek greater control over the proliferation of satellite internet terminals.

Unlike conventional internet connections that rely on telecommunications companies subject to national government oversight, Starlink terminals transmit data through satellites operated by SpaceX. This allows users to bypass local internet restrictions, maintain communications in conflict zones and coordinate activities on battlefields.

Starlink has become particularly important in Ukraine, where the military relies on the service to maintain communications along front lines and coordinate drone operations.

In May, Israel’s Haaretz newspaper and intelligence publication Intelligence Online separately reported that Israeli-owned companies were offering clients methods to identify and track Starlink users. Haaretz reported that the exploitation of advertising data appeared to play a significant role in these efforts.

Discover-Tech Linked to a Broader Suspected Surveillance Operation

On the same day TrendAI released its report on the group it called Shadow-Earth-79, Canada-based cybersecurity research organization Citizen Lab and U.S. advertising technology company Confiant publicly identified Discover-Tech.

Both organizations said the Israeli company had exploited the digital advertising auction process, which can expose information about internet users to prospective advertising buyers.

Through real-time advertising auctions, buyers can potentially obtain data about users and combine it with other information to identify otherwise anonymous individuals. Over time, these datasets can be used to track people across websites and, in some cases, prepare them for targeting with surveillance software.

Citizen Lab and Confiant said the advertisements had appeared across dozens of sensitive networks associated with media organizations, government institutions and technology companies.

Following the publication of their findings, Google, Comcast and several other companies said they had removed Discover-Tech from their advertising platforms.

According to one source familiar with the matter and another person with knowledge of the situation, at least one major U.S. technology company and an international organization have recently launched internal investigations to determine whether Discover-Tech’s advertisements had targeted their employees.

Yemen and South Sudan Among the Most Heavily Targeted Countries

TrendAI’s report identified suspicious advertising-buying patterns that researchers said suggested Shadow-Earth-79 may have been operating an infrastructure for targeting and tracking users rather than running a conventional commercial advertising business.

In addition to its apparent focus on Starlink-related traffic, the group was identified as the largest advertising buyer in Syria, Libya, Yemen and South Sudan, and the second-largest in Afghanistan.

TrendAI said demand for legitimate Western commercial advertising in sanctioned countries and conflict zones was virtually nonexistent. The report also described the group’s share of advertising auctions in several countries, including Hungary, Israel, Egypt, Azerbaijan and Venezuela, as extraordinarily high.

Six people familiar with the investigation told Reuters that TrendAI researchers were confident Discover-Tech was behind the suspicious advertising-auction activity and had even discussed naming the company in the final report.

However, five of those sources said TrendAI executives raised legal concerns, leading to a decision not to publicly attribute the activity to a specific company.

Cybersecurity industry experts say self-censorship is common in the sector, particularly when executives fear that exposing surveillance operations could trigger retaliation against their companies.

Earlier this year, U.S. cybersecurity company Palo Alto Networks removed explicit references to China from a report despite researchers’ confidence that China was responsible for a global cyberespionage campaign, Reuters previously reported.

The report was reportedly revised amid concerns that directly attributing the campaign to China could jeopardize Palo Alto Networks’ business operations in the country, which were already under pressure after Beijing instructed domestic companies to stop using the firm’s products.

Palo Alto Networks said the removal of direct references to China was unrelated to procurement regulations and restrictions in the country, describing claims to the contrary as “speculative and incorrect.”