Israeli firm turned Starlink traffic into espionage tool across 105 countries
Israeli firm turned Starlink traffic into espionage tool across 105 countries
TEHRAN — Recent disclosures from digital defense watchdogs have exposed an obscure Tel Aviv-registered advertising company, Discover-Tech, running aggressive online ad campaigns designed to geolocate and track users of SpaceX’s Starlink satellite internet network across more than 100 countries.
Investigative research by TrendAI, a division of Tokyo-based Trend Micro, revealed that Discover-Tech became the dominant global bidder for ad space displayed to Starlink terminals, according to a Reuters report on Oct. 27.
Operating under the internal threat codenamed "Shadow-Earth-79," the Israeli firm captured an implausibly high share of ad auctions in restricted or conflict-heavy jurisdictions including Syria, Libya, Yemen, South Sudan, and Venezuela.
By harvesting the metadata embedded in real-time bidding requests, Discover-Tech systematically turned routine browser traffic into an active intelligence pipeline.
From ad impressions to silent infiltration
Programmatic ad auctions rely on instant exchanges of telemetry. Every time an advertisement loads on a web page or mobile application, a bid request transmits the user's IP address, device model, software configuration, autonomous system number, and exact location parameters to participating ad networks.
Discover-Tech leveraged this routine infrastructure to build a comprehensive tracking map.
TrendAI concluded that the firm’s bidding behavior reflected a dedicated tracking operation rather than commercial marketing, noting that legitimate Western advertising demand in heavily sanctioned states is virtually non-existent.
On observed Starlink connections, Discover-Tech accounted for nearly 13 percent of winning ad bids worldwide.
The surveillance mechanism went far beyond passive location mapping. Concurrent technical investigations by Canada’s Citizen Lab and ad-security firm Confiant exposed a sophisticated exploitation vector named "AdFection."
Discover-Tech's proprietary ad platform served as a conduit, connecting mainstream advertising exchanges directly to mercenary spyware operators. When a targeted device loaded a background advertisement, Discover-Tech servers screened the incoming telemetry.
High-value targets were served malicious JavaScript that delivered zero-click attack payloads without requiring any user interaction, while ordinary users received empty responses.
Citizen Lab confirmed with high confidence that at least 45 devices belonging to news personnel at Al Jazeera were targeted with Candiru spyware through this ad-driven vector.
Starlink and the military-industrial infrastructure
The focus on Starlink underscores how low-Earth-orbit satellite constellations have become central to Western military strategy and intelligence operations.
SpaceX's Starlink network bypasses land-based telecommunications gateways, routing data through satellite links to circumvent national regulatory frameworks and local internet blocks.
The U.S. Department of "War" and NATO forces have integrated Starlink and its military-grade derivative, Starshield, into frontline combat operations. In Ukraine, the technology provides primary battlefield command architecture, directing artillery, facilitating real-time satellite coordination, and guiding long-range combat drones.
This deep integration into Western military operations makes Starlink terminals prime targets for intelligence agencies.
Intelligence outfits seek to identify, geolocate, and compromise satellite terminals operating inside sensitive sovereign territory.
Israeli-owned firms were already pitching commercial clients on specialized methodologies to map and deanonymize Starlink subscribers by exploiting commercial ad data.
The Discover-Tech operation confirms that these theoretical pitches were already operationalized at a global scale, turning satellite terminals into beacons for military intelligence gathering.
The broader ecosystem of Israeli cyber warfare
Discover-Tech represents the latest evolution of a commercial cyber-arms ecosystem cultivated by the Israeli regime.
For decades, intelligence entities such as Unit 8200 and Mossad have maintained an institutional pipeline into private surveillance vendors, enabling former Israeli operatives to commercialize state-funded hacking techniques.
Discover-Tech’s corporate history shows direct ties to veteran surveillance executives, including past directors associated with Circles, an affiliate of NSO Group, and Senpai Technologies, linked to the Intellexa consortium.
This ecosystem includes a wide network of offensive vendors. NSO Group gained global infamy through its Pegasus software, which infected the phones of diplomats, political opponents, and human rights defenders.
Candiru, operating under various corporate names such as Saito Tech and Integrity Labs, specialized in zero-click desktop compromises. Paragon Solutions markets its Graphite interception software, while Intellexa and Cytrox developed the Predator spyware suite.
Other key players include Cognyte, Cytrox, Cellebrite, and Black Cube, the private intelligence agency staffed by former Israeli operatives specializing in deception and corporate espionage.
These entities routinely establish international shell companies across Europe to bypass nominal export restrictions and maintain access to global markets.
Industry self-censorship and structural vulnerability
Despite the scale of Discover-Tech’s operations, accountability remains hindered by self-censorship within the commercial security sector.
TrendAI initially omitted Discover-Tech’s name from its public report, opting instead for the "Shadow-Earth-79" alias after corporate executives raised legal concerns.
This practice allows offensive operators to evade immediate platform bans and legal scrutiny.
Following the public identification by Citizen Lab and news outlets, major tech platforms including Google, Comcast's Beeswax, Vungle, and Eskimi cut off Discover-Tech’s access, while IAB Europe suspended the firm from its approved vendor list.
Internal inquiries were also launched by a major U.S. technology corporation and an international organization to evaluate potential employee targeting.
These platform removals disrupt specific operational routes, but the underlying vulnerability remains unaddressed.
Discover-Tech operated inside approved industry registries for years, utilizing standard European data privacy frameworks to collect targeting parameters.
As long as commercial advertising exchanges permit real-time data harvesting, state-aligned surveillance contractors will continue to use programmatic ad bidding as an unregulated, low-cost vector for global espionage.
source: tehrantimes.com