TrendAI Pins Starlink Ad Targeting on Israeli Firm Discover-Tech

Researchers at TrendAI, a unit of Tokyo-based Trend Micro, concluded that Israeli firm Discover-Tech was the No. 1 bidder on Starlink traffic in more than 100 countries, including several where Starlink itself was banned or restricted, Reuters reported.

TrendAI's October 15 report never named the company. It called the actor "Shadow-Earth-79" and said with moderate-to-high confidence that the bidding patterns looked like "targeting and tracking infrastructure rather than a commercial advertising operation." Six sources told Reuters that Shadow-Earth-79 was TrendAI's codename for Discover-Tech. TrendAI executives dropped the idea of publicly attributing the activity to a named company after raising legal concerns.

The scale shows up in the numbers. Across the entire Starlink sample, the operation accounted for 12.9% of winning advertisements against a 2.6% baseline share across traffic, nearly five times its ordinary presence. The firm was the top ad buyer in Syria, Libya, Yemen and South Sudan, places where "there is almost no demand" for legitimate Western ads. In Hungary, Israel, Egypt, Azerbaijan and Venezuela, it took an "implausibly dominant share" of Starlink bids.

On its codename practice, TrendAI said the method was aimed at avoiding "hype-driven labels" or "unstable actor names that can mislead defenders, distort risk prioritisation and trigger inappropriate response actions."

The same day the TrendAI report came out, Canada's Citizen Lab and New York ad-fraud firm Confiant publicly named Discover-Tech, tying its ad network to delivery of zero-click Candiru spyware against targets including Al Jazeera devices. The platforms had already moved: Alphabet removed Discover-Tech from Google's advertising vendor registries during the first week of October, IAB Europe removed it from its approved-vendor list on October 8, and Comcast's Beeswax severed access. It is our second Discover-Tech item in two weeks on our surveillance tracker.