Reported by 2 outlets
The story so far
AI summary of the reporting below · Updated · How we work
Discover-Tech, an Israeli advertising technology company, emerged as the top bidder for ad space tied to Starlink satellite internet traffic across more than 100 countries, according to reporting by Reuters citing six people familiar with the matter. Cybersecurity research by Trend Micro's TrendAI unit initially tracked the campaign under the moniker Shadow-Earth-79 before links pointed to Discover-Tech. The bidding patterns showed the firm becoming the leading ad buyer targeting Starlink connections in conflict-affected and sanctioned nations including Syria, Libya, Yemen, and South Sudan, as well as the second largest in Afghanistan. [1][2]
The operation exploited real-time digital advertising auctions to harvest user details across browsers and applications. The ads did not require users to click on them to start gathering information; simply serving the advert to a device allowed data collection that could geolocate terminals, build de-anonymized profiles, or set up targets for spyware. However, findings cited by Reuters do not confirm that specific Starlink subscribers were successfully tracked, and neither Discover-Tech nor SpaceX has commented on the matter. [1][2]
Following the disclosures, Google and Comcast confirmed they removed Discover-Tech from their ad platforms. The company previously drew scrutiny from Citizen Lab and ad security firm Confiant, which alleged Discover-Tech acted as a facilitator for mercenary spyware partners and targeted Al Jazeera journalists. Starlink terminals serve as critical communication tools during blackouts or state-mandated shutdowns, making terminal locations especially valuable to local authorities seeking to identify and penalize users. [1][2]
Malicious ads were deliberately served to Starlink users to uncover their identity and launch further surveillance efforts.
via TechRadar
Citizen Lab and Confiant linked Israeli firm Discover-Tech to suspected surveillance through online advertising. Researchers said its ads appeared across nearly 200,000 websites and mobile apps. TrendAI separately identified related activity under the codename “SHADOW-EARTH-79.” The findings raise concerns about ad auctions being exploited to track users across sensitive networks, though ad impressions alone do not confirm spyware infections.
via Tom’s Hardware