Discover-Tech's 100-Country Starlink Espionage Campaign: Ad Tech Goes Dark

The October Revelation: How an Israeli Ad Tech Firm Became the World's Top Starlink Tracker

Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, concluded the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX's Starlink service, and that the ads were likely being used to geolocate or otherwise surveil them.

Discover-Tech had become one of the world's leading bidders for ads aimed at Starlink users, and was the No 1 bidder on Starlink traffic in more than 100 countries, including several where Starlink itself was banned or restricted. This is the story behind those numbers—what they mean for diaspora technology workers, security-conscious olim, and anyone relying on satellite internet in conflict zones.

On October 15, TrendAI released a report about the targeting of Starlink users but did not name Discover-Tech, instead saying the party responsible was "an ad tech entity" which it called "Shadow-Earth-79." Two days later, the truth broke: Canadian cyber watchdog Citizen Lab and New York advertising technology firm Confiant outed Discover-Tech by name.

Why Starlink Users Matter: The Geopolitical Prize

Starlink terminals can sidestep local internet restrictions, communicate in hostile areas or coordinate action across battlefields because they route data through SpaceX-operated satellites rather than nationally regulated telecommunications firms.

This critical infrastructure advantage makes Starlink users asymmetrically valuable targets. Starlink has become a particularly important resource in Ukraine, whose military relies on the service for frontline communications and directing drone strikes.

The practical reality: Finding ways to track Starlink users has become a cottage industry as governments around the world try to get a grip on the spread of satellite internet terminals. Discover-Tech didn't invent this problem—it industrialized it.

The Advertising Weapon: How One Bid Becomes a Surveillance Infrastructure

Bidding refers to the complex auction system by which advertisers secure space inside people's browsers and apps. This is where Discover-Tech's operation became sophisticated and dangerous.

The Israeli company abused the ad bidding process, which can leak data about internet users back to the bidder. Over time, bidders can collect that leaked data, collate it and merge it with other information to de-anonymize users, follow them around the web and, in some cases, set them up for targeting with surveillance software.

The attack pattern targeted specific geographies and conflict zones. A Trend AI report noted the company's extensive activity in Syria, Libya, Yemen, South Sudan, and Afghanistan—areas experiencing conflict or subject to restrictions and sanctions.

When Cybersecurity Firms Self-Censor: The Legal Pressure Play

One aspect distinguishes this case: institutional hesitation. TrendAI researchers were convinced Discover-Tech was behind the suspicious bidding activity and discussed naming the company in TrendAI's report. But they eventually dropped the idea of publicly attributing the activity to a named company after TrendAI executives raised legal concerns.

This created a vacuum. TrendAI did not directly address questions about why its report did not identify Shadow-Earth-79 by name, saying its approach to attribution was aimed at reducing the risk of mistakes and avoiding "hype-driven labels" or "unstable actor names that can mislead defenders, distort risk prioritisation and trigger inappropriate response actions."

The delay mattered. Discover-Tech and its chief executive did not respond to requests for comment over the past two weeks.

Response and Platform Removal

Major ad platforms responded: Google removed Discover-Tech from its ad network; Beeswax, Eskimi, IAB Europe and Vungle also suspended or blocked the company's access.

Citizen Lab and Confiant said the ads had been shown inside dozens of sensitive networks belonging to media organizations, governments and tech firms. At least two major U.S. technology companies and one international organization launched internal probes into whether Discover-Tech had targeted their employees.

What This Means for Olim and Diaspora Tech Workers

For Israelis working in cybersecurity and tech, this case illustrates a hard truth: the ecosystem enables both innovation and misuse. Israel's cybersecurity industry is characterized by a high concentration of startups that develop new technologies in areas such as network security, endpoint protection, data security, cloud security, and threat intelligence. In recent years, the sector has attracted significant investment from both local and international venture capital firms, as well as major technology companies.

The Discover-Tech case also demonstrates how regulatory frameworks lag technology. U.S. and European platforms responded only after direct exposure by Citizen Lab. No statutory mechanism pre-emptively detected this operation.

For olim using Starlink—whether running a remote tech job from the Negev, supporting family in Eastern Europe, or working in cybersecurity consultancy—the practical lesson is that satellite internet, while valuable for bypassing ISP outages and content filters, carries amplified tracking risks if used by ad-targeting infrastructure.

FAQ: Understanding the Starlink Espionage Campaign

How did Discover-Tech target Starlink users without hacking the network? Rather than breach Starlink directly, Discover-Tech weaponized the legitimate digital advertising auction system. By bidding aggressively on ads aimed at Starlink IP addresses and device signatures, the company could observe patterns, collect data leakage from the bidding process itself, and correlate ad impressions with geolocation metadata.

Why did TrendAI wait to name Discover-Tech? Self-censorship is common in the cybersecurity industry, especially when executives fear that exposing surveillance operations could draw retribution. Legal risk and reputational concerns delayed public attribution—a pattern that leaves companies vulnerable to continued exploitation.

What platforms removed Discover-Tech? Google acted first and most visibly. Additional departures followed: Beeswax (programmatic ad exchange), Eskrimi, IAB Europe standards body, and Vungle (mobile ad network) all suspended or terminated Discover-Tech access within days of the October 15 report.

Who relies on Starlink that should be concerned? Journalists, humanitarian workers, frontline military (particularly Ukraine), NGO staff in conflict zones, and remote tech workers in restricted-internet regions face elevated targeting risk. Diaspora Israelis working for government-linked tech firms may also warrant monitoring.

The Bigger Context: Israeli Spyware and Data Fusion

An investigation by the Israeli newspaper Haaretz claims that two firms have developed "data fusion" techniques. The report describes a surveillance model that involves the large-scale analysis of advertising identifiers, smartphone telemetry, browsing traces, social media activity, and geolocation data to determine where Starlink terminals are operating and, in some cases, who is using them.

This represents a strategic shift. The investigation uncovers a new trend in cyber intelligence, moving away from spyware tools such as Pegasus and towards mass data analysis and surveillance models.

The Discover-Tech case isn't isolated. In May, Israeli newspaper Haaretz and the website Intelligence Online separately reported that Israeli-owned businesses were pitching clients on ways to identify and track Starlink users. Haaretz said exploiting ad data appeared to play a key role in the process.

What Comes Next: Enforcement and Accountability

As we covered in our analysis of civil-military dynamics, Israeli cyber firms operate in a permissive regulatory environment. What remains unclear: will Misrad Haklita or other government bodies condition aliyah incentives on technology sector ethics? Will the Israeli Association of Cyberspace and Internet Professionals establish enforcement standards?

For now, the framework relies on platform action and journalistic exposure. Governments have requested internal audits. European Union and U.S. regulators are examining advertising technology oversight broadly.

The Discover-Tech case will accelerate that push. The Jewish Agency and aliyah guidance counselors should flag satellite internet risks to olim relocating to frontier or conflict-adjacent regions. Cybersecurity professionals relocating to Israel should understand both the strengths and ethical liabilities of the local industry's most profitable practices.