Security researchers at TrendAI, a unit of Tokyo-based Trend Micro, recently found that Israeli ad-tech company Discover-Tech was heavily targeting Starlink users in a probable effort to spy on them, Reuters reported.
The findings were published in a TrendAI report on 15 October, but the actions were attributed to an ad-tech entity designated as Shadow-Earth-79.
Reuters cited six unnamed sources as saying Shadow-Earth-79 is TrendAI’s codename for Discover-Tech.
Starlink tracking
The researchers found that Discover-Tech was one of the biggest sources of digital ads shown to Starlink users and the ads were probably being used to geolocate or otherwise surveil them, the Reuters report said.
They reportedly found that Discover-Tech was one of the world’s leading bidders for ads aimed at Starlink users and was the top bidder for Starlink traffic in more than 100 countries, including several where Starlink is banned or restricted.
In its report, TrendAI said suspicious bidding indicated Shadow-Earth-79 was probably running “targeting and tracking infrastructure rather than a commercial advertising operation”.
Researchers found that Shadow-Earth-79 was the top buyer of ads in Syria, Libya, Yemen and South Sudan and was the second-highest ad buyer in Afghanistan even though “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero”, according to the TrendAI study.
Ad data
The entity also won an “implausibly dominant share” of bids in countries including Hungary, Israel, Egypt, Azerbaijan and Venezuela.
In May, Israeli newspaper and website Intelligence Online separately reported that Israeli-owned businesses were pitching clients on ways to track Starlink users.
said the methods appeared to involve exploiting ad data.
The ad bidding process can leak data about internet users back to the bidder, enabling them to de-anonymise users, track their web use and set them up for targeting with surveillance software.
On 15 October, the same day that TrendAI published its report, Canada’s Citizen Lab and New York ad-tech firm Confiant identified Discover-Tech by name, saying the company had abused the ad bidding process to try to collect data on users.
Sensitive networks
They said Discover-Tech’s ads had been shown in dozens of sensitive networks belonging to media organisations, governments and tech companies.
Google, Comcast and other companies subsequently said they had removed Discover-Tech from their ad platforms.
TrendAI refrained from naming Discover-Tech in its study after executives raised legal concerns, the Reuters report said, citing five unnamed people familiar with the matter.
TrendAI said its attribution method is aimed at reducing the risk of mistakes and avoiding “hype-driven labels” or “unstable actor names” that can risk mistakes being made.