Tracking users through web advertisements is nothing new; however, doing so on a large scale requires significant effort and financial investment. Yet, this is precisely what was recently uncovered by TrendAI, a research subsidiary of the digital security firm TrendMicro.
The report reveals that an Israeli ad-tech company, Discover-Tech, has been using web advertisements to track users of the Starlink internet service across more than 100 countries. This is achieved through the Real-Time Bidding (RTB) process, which serves web ads to users' devices.
TrendAI also discovered that Discover-Tech serves as a front for a digital espionage group known as SHADOW-EARTH-79. As previously reported, this group has been active in winning RTB ad auctions in 49 countries—nations currently subject to travel advisories, undergoing general elections, or facing economic sanctions from major powers like the United States. Examples include Egypt, Israel, Hungary, Azerbaijan, and Venezuela.
Furthermore, the group has been observed bidding for numerous advertising slots targeting Starlink users in Southeast Asia, including in Malaysia and Thailand.
These ad bids are executed via the Starlink network, which is often the preferred connectivity option in regions where traditional infrastructure—such as broadband, fiber optics, or 4G/5G cellular towers—is unavailable or difficult to deploy. A notable example is the Ukrainian government’s reliance on Starlink during the conflict with Russia, prior to restrictions being placed on its usage.
In such environments, it is highly likely that local authorities and government entities utilize these internet services; consequently, conducting espionage against these officials serves as an effective method for tracking them. The TrendAI report also reveals the infrastructure employed by SHADOW-EARTH-79, which includes platforms for tracking telemetry data—such as the collection of IP addresses, user movement profiles, and the injection of scripts into devices—as well as the capability to identify users based on their device usage patterns and internet network activity.
What is particularly alarming about this method of espionage is that it does not require the use of malicious software (malware). With sufficient funds and expertise, tracking via web advertisements is enough to gain a general understanding of a target; the information obtained can then be leveraged for various other types of espionage activities.
