{"id":3414,"date":"2026-10-28T11:04:18","date_gmt":"2026-10-28T06:04:18","guid":{"rendered":"https:\/\/ipp-news.com\/?p=3414"},"modified":"2026-10-28T11:04:18","modified_gmt":"2026-10-28T06:04:18","slug":"israeli-spy-company-heavily-targeted-starlink-users-report","status":"publish","type":"post","link":"https:\/\/ipp-news.com\/?p=3414","title":{"rendered":"Israeli spy company heavily targeted Starlink users: Report"},"content":{"rendered":"
\n

Experts at a digital defence firm recently found that an Israeli ad tech company was heavily targeting users of \u200bStarlink\u2019s satellite internet service in a likely effort to spy on them, according to six people familiar with the matter.<\/strong><\/p>\n

Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, \u200cconcluded the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX\u2019s Starlink service and that the ads were likely being used to geolocate or otherwise surveil them, according to the six people.<\/p>\n

The researchers, who drew on digital advertising data in TrendAI\u2019s telemetry for their conclusions, found that Discover-Tech had become one of the world\u2019s leading bidders for ads aimed at Starlink users and that it was the No. 1 bidder on Starlink traffic in more than \u200b100 countries, including several where Starlink itself was banned or restricted.<\/p>\n

Bidding refers to the complex auction system by which advertisers secure space inside people\u2019s browsers and apps.<\/p>\n

SpaceX did not respond to \u200brequests for comment. Discover-Tech and its chief executive did not respond to requests for comment over the past two weeks.<\/p>\n

TrendAI released a report<\/a> on October 15 about \u2060the targeting of Starlink users but did not name Discover-Tech, instead saying the party responsible was \u201can ad tech entity\u201d which it called \u201cShadow-Earth-79.\u201d The six sources said Shadow-Earth-79 is TrendAI\u2019s codename for Discover-Tech.<\/p>\n

TrendAI did not directly address \u200bquestions about why its report did not identify Shadow-Earth-79 by name, saying in a statement that its approach to attribution<\/a> was aimed at reducing the risk of mistakes and avoiding \u201chype-driven labels\u201d or \u201cunstable actor names that can mislead \u200bdefenders, distort risk prioritisation, and trigger inappropriate response actions.\u201d<\/p>\n

Finding ways to track Starlink users has become a cottage industry as governments around the world try to get a grip on the spread of satellite internet terminals.<\/p>\n

Because they route data through SpaceX-operated satellites rather than nationally regulated telecommunications firms, the terminals can sidestep local internet restrictions, communicate in hostile areas or coordinate action across battlefields.<\/p>\n

Starlink has become a particularly important resource<\/a> in Ukraine, whose military relies on the service for frontline communications<\/a> and directing drone \u200bstrikes<\/a>.<\/p>\n

In May, Israeli newspaper Haaretz and the website Intelligence Online separately<\/a> reported<\/a> that Israeli-owned businesses were pitching clients on ways to identify and track Starlink users. Haaretz said exploiting ad data appeared to play a key role in \u200bthe process.<\/p>\n

<\/a>Discover-tech accused of wider spy effort<\/strong><\/h3>\n

The same day that TrendAI published its report on Shadow-Earth-79, Canadian cyber watchdog Citizen Lab and New York advertising technology firm Confiant outed Discover-Tech by name<\/a>.<\/p>\n

Both groups said the Israeli company abused the ad \u200cbidding process, which \u2060can leak data about internet users back to the bidder.<\/p>\n

Over time, bidders can collect that leaked data, collate it and merge it with other information to de-anonymise users, follow them around the web and, in some cases, set them up for targeting with surveillance software.<\/p>\n

Citizen Lab and Confiant said the ads had been shown inside dozens of sensitive networks, <\/a>including those belonging to media organisations, governments and tech firms<\/a>.<\/p>\n

In response to the investigations, Google, Comcast and other companies said they had removed Discover-Tech from their ad platforms.<\/p>\n

At least one big US tech company and one international organisation recently launched internal inquiries into whether Discover-Tech\u2019s ads targeted their employees, according to one of the people \u200band a seventh person familiar with the matter.<\/p>\n

<\/a>Top advertiser in Yemen, South Sudan<\/strong><\/h3>\n

TrendAI\u2019s report cited suspicious bidding \u2060patterns that suggested Shadow-Earth-79 was running \u201ctargeting and tracking infrastructure rather than a commercial advertising operation.\u201d<\/p>\n

In addition to noting the \u201cobvious skew\u201d towards buying ads aimed at Starlink users, the report said that Shadow-Earth-79 was the top buyer of ads in Syria, Libya, Yemen and South Sudan and was the No. 2 ad buyer in Afghanistan, even though \u201cthe\u202fdemand\u202ffor legitimate\u202fWestern advertising in sanctioned or active-conflict\u202fstates is effectively zero.\u201d<\/p>\n

It said the entity won \u201can implausibly dominant share\u201d of bids in several countries including Hungary, \u200bIsrael, Egypt, Azerbaijan and Venezuela.<\/p>\n

TrendAI \u2060researchers were convinced Discover-Tech was behind the suspicious bidding activity and discussed naming the company in TrendAI\u2019s report, according to the six people familiar with the matter.<\/p>\n

But they eventually dropped the idea of publicly attributing the activity to a named company after TrendAI executives raised legal concerns, five of the sources said.<\/p>\n

Self-censorship is common in the cybersecurity industry, especially when executives fear that exposing surveillance operations could draw retribution, industry experts say.<\/p>\n

Earlier this year, US cybersecurity \u2060company Palo \u200bAlto stripped explicit references to China from a report on a global cyberespionage campaign even though its researchers were confident the hacking \u200bcould be pinned on Beijing, Reuters reported at the time<\/a>.<\/p>\n

Reuters said the report was watered down over fears that calling out China would cause problems for Palo Alto\u2019s operations there, which were already under scrutiny following a Beijing directive ordering domestic companies not to use \u200bits products<\/a>.<\/p>\n

Palo Alto said the lack of attribution in its report was not correlated with \u201cprocurement regulations in China\u201d and that any suggestion otherwise was \u201cspeculative and false.\u201d<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Experts at a digital defence firm recently found that an Israeli ad tech company was heavily targeting users of \u200bStarlink\u2019s satellite internet service in a likely effort to spy on them, according to six people familiar with the matter. Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, \u200cconcluded the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX\u2019s Starlink service and that the ads were likely being used to geolocate or otherwise surveil them, according to the six people.…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[],"class_list":["post-3414","post","type-post","status-publish","format-standard","hentry","category-english"],"gutentor_comment":0,"_links":{"self":[{"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/posts\/3414","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ipp-news.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3414"}],"version-history":[{"count":0,"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/posts\/3414\/revisions"}],"wp:attachment":[{"href":"https:\/\/ipp-news.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3414"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ipp-news.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3414"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ipp-news.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}