Experts at a digital defence firm recently found that an Israeli advertising technology (ad-tech) company was heavily targeting users of Starlink’s satellite internet service in a likely effort to spy on them, according to six people familiar with the matter.
Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, concluded that the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX’s Starlink service, and that the ads were likely being used to geolocate or otherwise surveil them, the six people said.
The researchers drew on digital advertising data in TrendAI’s telemetry, the data gathered by its security products. They found that Discover-Tech had become one of the world’s leading bidders for ads aimed at Starlink users, and that it was the top bidder on Starlink traffic in more than 100 countries, including several where Starlink itself is banned or restricted. Bidding refers to the complex auction system through which advertisers secure space inside people’s browsers and apps.
SpaceX did not respond to requests for comment. Discover-Tech and its CEO did not respond to requests for comment over the past two weeks.
TrendAI released a report on 15 October about the targeting of Starlink users but did not name Discover-Tech. It said instead that the party responsible was “an ad-tech entity”, which it called “Shadow-Earth-79”. The six sources said Shadow-Earth-79 is TrendAI’s codename for Discover-Tech.
TrendAI did not directly address questions about why its report did not name Shadow-Earth-79. It said in a statement that its approach to attribution was aimed at reducing the risk of mistakes and avoiding “hype-driven labels” or “unstable actor names that can mislead defenders, distort risk prioritisation and trigger inappropriate response actions”.
A cottage industry
Finding ways to track Starlink users has become a cottage industry as governments around the world try to get a grip on the spread of satellite internet terminals. Because the terminals route data through SpaceX-operated satellites rather than nationally regulated telecoms companies, they can sidestep local internet restrictions, communicate in hostile areas or co-ordinate action across battlefields. Starlink has become a particularly important resource in Ukraine, whose military relies on the service for frontline communications and directing drone strikes.
In May, Israeli newspaper Haaretz and the website Intelligence Online separately reported that Israeli-owned businesses were pitching clients on ways to identify and track Starlink users. Haaretz said exploiting ad data appeared to play a key role in the process.
On the same day that TrendAI published its report on Shadow-Earth-79, Canadian cyber watchdog Citizen Lab and New York ad-tech firm Confiant named Discover-Tech.
Both groups said the Israeli company abused the ad bidding process, which can leak data about internet users back to the bidder. Over time, bidders can collect that leaked data, collate it and merge it with other information to de-anonymise users, follow them around the web and, in some cases, set them up to be targeted with surveillance software.
Citizen Lab and Confiant said the ads had been shown inside dozens of sensitive networks belonging to media organisations, governments and tech companies.
In response to the investigations, Google, Comcast and other companies said they had removed Discover-Tech from their ad platforms.
At least one big US tech company and one international organisation recently launched internal inquiries into whether Discover-Tech’s ads targeted their employees, according to one of the six people and a seventh person familiar with the matter.
TrendAI’s report cited suspicious bidding patterns suggesting that Shadow-Earth-79 was running “targeting and tracking infrastructure rather than a commercial advertising operation”.
Besides the “obvious skew” towards buying ads aimed at Starlink users, the report said Shadow-Earth-79 was the top buyer of ads in Syria, Libya, Yemen and South Sudan, and the second biggest in Afghanistan, even though “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero”. It said the entity won “an implausibly dominant share” of bids in several countries, including Hungary, Israel, Egypt, Azerbaijan and Venezuela.
TrendAI researchers were convinced Discover-Tech was behind the suspicious bidding and discussed naming the company in the report, according to the six people. But they dropped the idea after TrendAI executives raised legal concerns, five of the sources said.
Self-censorship
Self-censorship is common in the cybersecurity industry, especially when executives fear that exposing surveillance operations could draw retribution, industry experts say.
Earlier this year, US cybersecurity company Palo Alto Networks stripped explicit references to China from a report on a global cyberespionage campaign, even though its researchers were confident the hacking could be pinned on Beijing, Reuters reported at the time. Reuters said the report was watered down over fears that calling out China would cause problems for Palo Alto’s operations there, which were already under scrutiny after a Beijing directive ordered domestic companies not to use its products. Palo Alto said the lack of attribution in its report was not correlated with “procurement regulations in China” and that any suggestion otherwise was “speculative and false”. – Raphael Satter, (c) 2026 Reuters
