An Israeli online advertising company implicated in spyware attacks targeting internet users was heavily active on SpaceX’s Starlink service, Japanese researchers have found, bolstering claims that the firm was running a “targeting and tracking” operation masquerading as a commercial advertising business.
Earlier this month, Canadian cybersecurity watchdog Citizen Lab and New York-based ad security firm Confiant published extensive investigations identifying Discover-Tech, an Israeli advertising technology company, as a middleman helping spyware firms, including Candiru and Intelos, as well as a little-known US-linked operator known as Dark Cartographer, track internet users and potentially infect their devices without their knowledge.
Discover-Tech’s operation involved purchasing advertising space on hundreds of thousands of websites and apps, using ads to collect information about users who viewed them, and making the data available to spyware companies. Those firms could then identify specific targets and potentially install spyware on their devices through malicious advertising code.
Despite presenting itself as a commercial operation, Discover-Tech concentrated much of its advertising spending on markets that would be of limited interest to conventional advertisers. Of 228 countries and territories examined, Palestine was the most heavily targeted, despite its population having severely limited access to Western goods and relatively little purchasing power.
Read more: US tells Gulf allies to brace for ‘intense’ war with Iran – WSJ
In more than 100 countries, Discover-Tech was the leading bidder for advertising space targeting Starlink users, according to researchers at TrendAI, a unit of Japanese cybersecurity firm Trend Micro. The company was also the largest advertising bidder in Syria, Libya, Yemen, and South Sudan, and the second-largest in Afghanistan.
TrendAI published its findings on October 15, identifying the suspicious advertiser only by the codename Shadow-Earth-79. Six people familiar with the research subsequently told Reuters that the codename referred to Discover-Tech.
Noting that “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero,” the researchers concluded that the company was running “targeting and tracking infrastructure rather than a commercial advertising operation.”
The findings suggest that Discover-Tech may have been attempting to identify, geolocate, or monitor Starlink users. However, they do not establish that the company successfully infected Starlink users’ devices with spyware.
