Executive Summary
Recent investigative reporting and technical research have uncovered a sophisticated surveillance campaign targeting users of the SpaceX Starlink satellite internet service. The campaign, attributed to the Israeli ad tech company Discover-Tech, exploited the digital advertising ecosystem—specifically real-time bidding (RTB) mechanisms—to collect sensitive metadata on Starlink users globally. This activity, which persisted for years and spanned over 100 countries, enabled the potential de-anonymization, geolocation, and further targeting of individuals, including those in conflict zones and countries where Starlink is banned or restricted. The exposure of this campaign has led to the removal of Discover-Tech from major ad platforms, but the incident highlights the persistent risk of ad tech abuse for surveillance purposes. This report provides a comprehensive technical analysis, threat actor profile, exploitation context, and actionable mitigation guidance for organizations and individuals at risk.
Threat Actor Profile
Discover-Tech is an Israeli-based ad tech company with a history of aggressive and opaque operations within the digital advertising supply chain. According to research by TrendAI (a division of Trend Micro), Citizen Lab, and Confiant, Discover-Tech (internally codenamed “SHADOW-EARTH-79”) leveraged its privileged position in the RTB ecosystem to systematically target Starlink users. The company’s infrastructure and bidding patterns suggest a deliberate focus on high-value intelligence targets, including users in sanctioned, conflict, and surveillance-heavy jurisdictions. While not directly attributed to a nation-state advanced persistent threat (APT) group, the operational sophistication and targeting profile of Discover-Tech align with state-level surveillance interests. Previous reporting has also linked Discover-Tech to the delivery of commercial spyware, including the Candiru platform (now rebranded as Integrity Labs), via malicious ad payloads.
Technical Analysis of Malware/TTPs
The core technical vector exploited by Discover-Tech was the abuse of the RTB process in digital advertising. RTB allows advertisers to bid in real time for ad placements on websites and mobile applications. During this process, ad exchanges transmit granular metadata—including IP addresses, device fingerprints, geolocation data, and browsing context—to all participating bidders, regardless of whether they win the auction. Discover-Tech systematically outbid competitors for ad inventory associated with Starlink traffic, particularly in regions with low commercial value but high intelligence interest, such as Syria, Libya, Yemen, South Sudan, and Afghanistan.
By aggregating RTB data across millions of ad impressions, Discover-Tech could build detailed profiles of Starlink users, including their physical locations, device types, and browsing habits. In some documented cases, the company’s infrastructure was used to deliver zero-click spyware payloads, notably the Candiru platform, to targeted devices via malicious ad creatives. This enabled remote device compromise without user interaction, as observed in the infection of at least 45 devices at Al Jazeera between 2024 and 2025.
The technical tactics, techniques, and procedures (TTPs) observed include:
Abuse of RTB metadata exposure to collect user IP addresses, device IDs, and geolocation coordinates; persistent dominance in ad auctions for Starlink-related traffic, especially in non-commercial or high-risk regions; delivery of malicious ad payloads capable of exploiting browser or OS vulnerabilities for spyware installation; use of obfuscated infrastructure and shell companies to mask bidding activity and evade detection by ad exchanges.
Relevant MITRE ATT&CK techniques include T1599.001 (Network Traffic Capture or Redirection: Adversary-in-the-Middle), T1087 (Account Discovery), and T1204 (User Execution).
Exploitation in the Wild
The exploitation campaign was global in scope, with Discover-Tech winning the majority of ad auctions for Starlink traffic in over 100 countries. Telemetry from TrendAI and Confiant revealed that the company’s ads appeared on more than 75,000 mobile applications and over 120,000 websites accessed via Starlink connectivity. Notably, the campaign targeted sensitive networks, including those belonging to media organizations, government agencies, international bodies (such as NATO, the European Parliament, the U.S. Department of Defense, the International Atomic Energy Agency, and the International Criminal Court), and military entities.
In Ukraine, where Starlink is a critical component of military communications and drone operations, the ability to geolocate and track users could have direct kinetic consequences. In other conflict zones and authoritarian states, the surveillance of Starlink users poses severe risks to dissidents, journalists, humanitarian workers, and other high-risk individuals circumventing local internet controls.
Following the public exposure of the campaign, major ad platforms—including Google and Comcast—removed Discover-Tech from their networks. However, the underlying vulnerabilities in the RTB ecosystem remain unaddressed, and similar surveillance operations could be conducted by other actors with access to ad bidding infrastructure.
Victimology and Targeting
The victimology of this campaign is notable for its breadth and precision. Starlink users in Argentina, the Philippines, and Japan experienced the highest rates of ad auction wins by Discover-Tech (over 80% in some cases), but the company’s dominance was also observed in Syria, Libya, Yemen, South Sudan, Afghanistan, Hungary, Israel, Egypt, Azerbaijan, and Venezuela. The targeting extended to users in countries where Starlink is officially banned or heavily restricted, indicating a deliberate effort to surveil individuals circumventing state censorship or sanctions.
Sensitive organizations affected include media outlets (notably Al Jazeera), international governmental bodies, and military networks. The campaign’s focus on non-commercial, high-risk environments suggests an intelligence-gathering motive rather than purely commercial ad targeting.
Mitigation and Countermeasures
Organizations and individuals using Starlink or similar satellite internet services should adopt a multi-layered approach to mitigate the risks associated with ad tech surveillance:
Implement network-level ad blocking and DNS filtering to prevent the loading of third-party ad content, especially from untrusted or opaque ad exchanges. Monitor network traffic for anomalous ad requests and responses, particularly those originating from or destined for infrastructure associated with known surveillance actors such as Discover-Tech. Employ endpoint security solutions capable of detecting and blocking malicious ad payloads, including zero-click exploits. Limit the use of ad-supported applications and websites on devices handling sensitive communications or operating in high-risk environments. Advocate for greater transparency and security controls within the digital advertising ecosystem, including the minimization of metadata exposure during RTB processes.
While major ad platforms have removed Discover-Tech, organizations should remain vigilant for similar patterns of ad bidding dominance and metadata aggregation by other entities. Regular threat intelligence updates and collaboration with trusted cybersecurity partners are essential for early detection and response.
References
Reuters: Alleged Israeli spy company heavily targeted Starlink users
Gizmodo: Researchers Uncover Signs of Massive Surveillance Operation on Starlink Users
Citizen Lab: AdTech Surveillance
Confiant: AdTech Threat Intelligence
Trend Micro: TrendAI Threat Research
MITRE ATT&CK: T1599.001, T1087, T1204
About Rescana
Rescana is a leader in third-party risk management (TPRM) and cyber threat intelligence. Our platform empowers organizations to continuously monitor, assess, and mitigate cyber risks across their digital supply chain. By leveraging advanced analytics and real-time threat intelligence, Rescana enables proactive defense against emerging threats in the evolving cyber landscape.
We are happy to answer any questions at info@rescana.com.
