At a Glance:

• A cybersecurity firm has reportedly flagged suspicious ad activity linked to an Israeli company.

• The activity is believed to have targeted users of a satellite internet service.

• Several tech companies have since taken action.

Cybersecurity researchers have concluded that an Israeli ad tech company was heavily targeting users of Starlink's satellite internet service in a likely effort to spy on them, according to six people familiar with the matter.

Key Statements and Focus Area:

• TrendAI's Findings: "Targeting and tracking infrastructure rather than a commercial advertising operation." — TrendAI report on the entity it codenamed Shadow-Earth-79.

• TrendAI's Defense of Its Approach: TrendAI said its attribution approach aims to avoid "hype-driven labels" that can mislead defenders. — TrendAI statement.

• Focus of the Article: The article centers on allegations that Israeli firm Discover-Tech used ad bidding to geolocate and surveil Starlink users and on why TrendAI's own report did not name the company.

Researchers at TrendAI, a unit of Tokyo-based Trend Micro, found that Discover-Tech was among the world's top bidders for ads shown to Starlink users and the No. 1 bidder on Starlink traffic in more than 100 countries, including some where Starlink is banned or restricted. TrendAI's report, published October 15, referred only to an "ad tech entity" codenamed Shadow-Earth-79. The six sources said that is TrendAI's internal name for Discover-Tech.

They added that researchers had discussed naming the company but dropped the idea after executives raised legal concerns, according to five of the sources. Discover-Tech and its chief executive did not respond to requests for comment over the past two weeks.

The same day, Canadian watchdog Citizen Lab and New York ad tech firm Confiant named Discover-Tech directly, saying it abused the ad bidding process, which can leak user data back to the bidder. Over time, that data can be combined to de-anonymize users, track them across the web and, in some cases, set them up for surveillance software.

They said the ads appeared inside dozens of sensitive networks. Google, Comcast, and other companies removed Discover-Tech from their platforms, and at least one large US tech company and one international organization have opened internal inquiries into whether their employees were targeted.

TrendAI's report also said the entity was the top ad buyer in Syria, Libya, Yemen, and South Sudan and No. 2 in Afghanistan, despite what it called effectively zero legitimate Western advertising demand in such states. It also won an implausibly dominant share of bids in countries including Hungary, Israel, Egypt, Azerbaijan, and Venezuela.

Industry experts say self-censorship is common in cybersecurity when firms fear retribution, a pattern Reuters previously reported at Palo Alto Networks over a report on a cyberespionage campaign.

FYI

Starlink terminals route data through SpaceX-operated satellites rather than national telecom firms, letting users sidestep local internet restrictions, communicate in hostile areas, and coordinate across battlefields. That has made them a target for governments and surveillance vendors, and Starlink is especially vital to Ukraine's military for frontline communications and directing drone strikes.

In May, Israeli newspaper Haaretz and the website Intelligence Online separately reported that Israeli-owned businesses were pitching clients on ways to identify and track Starlink users, with ad data appearing to play a key role.

Dive Deeper: Handpicked Stories for You

Follow Channel8 for continuous updates:

Countries Navigate US-China Rivalry Over Artificial Intelligence

OpenAI Says Research Agent Used Crypto Wallet Without Permission