Israeli Ad Tech Firm Allegedly Exploited Starlink for Surveillance
Researchers identify Discover-Tech as the entity behind suspicious ad bidding targeting satellite internet users.
1Surveillance via Ad Bidding
Cybersecurity researchers at TrendAI identified that Israeli firm Discover-Tech heavily targeted Starlink satellite internet users. By participating in complex digital advertising auctions, the company allegedly sought to geolocate and surveil individuals. This method leverages the ad bidding ecosystem to collect leaked user data, effectively turning commercial advertising into a tracking tool.
2Global Bidding Dominance
Discover-Tech emerged as the top bidder for Starlink traffic across more than 100 countries. The firm maintained a dominant presence even in regions where Starlink is restricted or banned. Researchers noted that the demand for legitimate Western advertising in these active-conflict or sanctioned states is effectively zero, signaling malicious intent.
3The Shadow-Earth-79 Codename
In an October 15 report, TrendAI referred to the responsible entity as Shadow-Earth-79 to avoid hype-driven labels. Six sources confirmed this codename points directly to Discover-Tech. TrendAI executives reportedly blocked the public naming of the company in their initial report, citing legal concerns and the desire to avoid potential industry retribution.
4De-anonymization and Tracking
Citizen Lab and Confiant revealed that Discover-Tech abused ad bidding processes to de-anonymize users. By collating leaked data, the firm could follow targets across the web and potentially deploy surveillance software. These ads appeared within sensitive networks, including those belonging to various media organizations, government agencies, and private technology firms globally.
5Industry Response and Removal
Following investigations by Citizen Lab and Confiant, major platforms including Google and Comcast removed Discover-Tech from their advertising ecosystems. At least one prominent US tech company and an international organization have launched internal inquiries. They are currently assessing whether Discover-Tech’s ads successfully targeted their employees or compromised their internal network security.
6Strategic Value of Starlink
Starlink has become a critical resource for communications in hostile areas and active battlefields, notably in Ukraine. Because the service routes data through SpaceX satellites rather than nationally regulated telecommunications firms, it bypasses local internet restrictions. This unique architecture makes Starlink users high-value targets for state-level actors and private surveillance firms.
7Patterns of Self-Censorship
The decision to withhold the company name in the TrendAI report reflects broader trends of self-censorship in cybersecurity. Firms often fear that exposing surveillance operations could draw retaliation or damage business interests. Similar patterns were observed earlier this year when Palo Alto Networks removed explicit references to China from a cyberespionage report.
8Implications for Digital Privacy
This incident highlights the vulnerability of users relying on satellite internet to bypass state-controlled infrastructure. The exploitation of ad-tech auctions demonstrates how commercial data streams are being weaponized for intelligence gathering. As satellite connectivity expands, the risk of ad-based surveillance remains a significant concern for organizations operating in high-risk environments.