EN PT-BR
← Voltar ao feed
medium government military media technology telecommunications

SHADOW-EARTH-79 abuses real-time ad bidding to track Starlink users in 105 countries; Reuters links it to Israeli firm Discover-Tech

2 fonte(s) · 2 atualização(ões) · publicado 28/10/2026 02:08 · coletado há 4 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 29/10/2026 00:08; os links antigos trazem para cá.

Fontes: securityaffairs.com ↗ gbhackers.com ↗

TrendAI, a unit of Trend Micro, reported an operation it tracks as SHADOW-EARTH-79 that abuses the real-time bidding (RTB) ad ecosystem. TrendAI assesses with moderate-to-high confidence that the operation works as targeting and tracking infrastructure for geolocation and surveillance rather than as a commercial ad business (gbhackers.com, securityaffairs.com). It dominates Starlink ad traffic in 105 countries, with about 12.9% of observed Starlink impressions against a 2.6% baseline (gbhackers.com). TrendAI's report was published on October 15, and on October 27 Reuters, citing six anonymous sources, identified SHADOW-EARTH-79 as the Israeli ad tech firm Discover-Tech (securityaffairs.com). Citizen Lab and Confiant separately named Discover-Tech for abusing ad bidding. Google, Comcast and other companies say they removed it from their platforms. SpaceX and Discover-Tech did not respond to requests for comment (securityaffairs.com). TrendAI has not published the Discover-Tech attribution itself.

Detalhes técnicos

  • RTB bid requests can expose IP addresses, geolocation, autonomous system numbers and device characteristics to competing bidders. Combined with advertising identifiers, click records and location histories, this enables detailed behavioral profiles without user interaction (gbhackers.com).
  • Citizen Lab and Confiant say a bidder can collate leaked data over time and merge it with other information to de-anonymize users and track them across the web. In some cases this can set them up for targeting with surveillance software (securityaffairs.com).
  • Winning bidders deliver ad content that may include JavaScript for further collection, such as movement profiling, device fingerprinting and interest analysis. The research does not confirm that every impression delivered malicious code or compromised a device (gbhackers.com).
  • Researchers used AI-assisted analysis to reconstruct the operator's application from exposed JavaScript bundles and infrastructure artifacts. The recovered interface showed manual script injection, de-anonymization and advanced IP filtering (gbhackers.com).
  • The operation bought 66,208 Starlink impressions over 90 days, a 4.9-fold increase in interest, not in confirmed victims (gbhackers.com).
  • It captured 91.1% of observed bids in Hungary, 90.1% in Israel and 77.2% in Egypt (gbhackers.com). It also holds implausibly dominant shares in Azerbaijan and Venezuela (securityaffairs.com).
  • It is the top ad buyer in Syria, Libya, Yemen and South Sudan and second in Afghanistan. TrendAI says legitimate Western ad demand in sanctioned or conflict states is effectively zero (securityaffairs.com).
  • By raw volume it is the second-largest winning bidder, with a clear skew toward Starlink address space (securityaffairs.com).
  • The ads appeared inside dozens of sensitive networks belonging to media organizations, governments and tech firms. At least one large US tech company and one international organization have opened internal inquiries into whether their employees were targeted (securityaffairs.com).
  • Haaretz and Intelligence Online reported in May that Israeli-owned businesses were pitching clients on ways to identify and track Starlink users, with ad data apparently key (securityaffairs.com).
  • Reuters reports that TrendAI researchers wanted to name Discover-Tech but dropped the idea after executives raised legal concerns (securityaffairs.com).
  • Dataset: 84,710,348 requests from 2025-12-31 to 2026-08-15, 154 buyer seats and 232 country classifications. Visibility was limited to one demand-side platform, and IP geolocation uncertainty affected some Starlink country assignments. The findings describe traffic categories, not confirmed victim counts (gbhackers.com).

Remediação

  • Restrict advertising traffic on sensitive devices and networks, limit ad-supported apps, disable ad personalization, review app permissions and reset advertising identifiers. These measures reduce exposure but do not guarantee protection (gbhackers.com).
  • Block connections to advertising backends or strip ad tags before data leaves the device. Merely hiding ads can leave tracking requests intact (gbhackers.com).
  • For high-risk personnel, combine network filtering, restrictive permissions and device protection modes. Investigate suspicious bidders and block identified surveillance infrastructure where feasible (gbhackers.com).
  • Organizations with staff in sensitive locations or using Starlink may review ad-tech exposure and check whether Discover-Tech-linked ads reached their networks. Ad platforms have removed Discover-Tech (securityaffairs.com).

Relatos divergentes

  • Attribution: gbhackers.com (October 28, earlier) only uses the codename SHADOW-EARTH-79. securityaffairs.com (later) adds that Reuters names it as Discover-Tech. This rests on anonymous sources and is not a published TrendAI statement, so treat it as unconfirmed.
  • Scale metrics: gbhackers.com describes the operation as the largest winning bidder in 49 countries and dominant in Starlink traffic in 105 countries. securityaffairs.com calls it the top bidder in 105 countries of observed Starlink traffic and only the second-largest winner by raw volume. The two figures appear to measure different things (all traffic versus Starlink traffic).
  • Share figures: gbhackers.com gives 12.9% against a 2.6% baseline. securityaffairs.com gives about 13% against about 3%, which is consistent but rounded.

Linha do tempo

  1. securityaffairs.com ↗ · pub. 28/10/2026 11:37 · coletado 28/10 14:00

    TrendAI flags Shadow-Earth-79, reportedly Israeli ad tech firm Discover-Tech, for ad-bid geolocation tracking of Starlink users

    ler a análise desta fonte

    TrendAI (a unit of Trend Micro) published a report on October 15 describing an ad tech entity it tracks as SHADOW-EARTH-79. Per a Reuters story of October 27 citing six sources, this is TrendAI's codename for the Israeli firm Discover-Tech. The attribution rests on those anonymous sources, not on a published TrendAI statement. TrendAI assessed with moderate-to-high confidence that the entity's advertising presence works as targeting and tracking infrastructure for geolocation and surveillance, not as a commercial ad operation. Citizen Lab and Confiant separately named Discover-Tech on the same day, saying it abused the ad bidding process. Google, Comcast and other companies said they removed Discover-Tech from their ad platforms. SpaceX and Discover-Tech did not respond to requests for comment.

    Technical Details

    • SHADOW-EARTH-79 is the top bidder in 105 countries in observed Starlink traffic and accounts for about 13% of winning bid events, against about 3% for other bidders. By raw volume it is the second-largest winning bidder, with a clear skew toward Starlink address space.
    • It is the top ad buyer in Syria, Libya, Yemen and South Sudan and second in Afghanistan. It also holds implausibly dominant bid shares in Hungary, Israel, Egypt, Azerbaijan and Venezuela. TrendAI says legitimate Western ad demand in sanctioned or conflict states is effectively zero.
    • Citizen Lab and Confiant say the bidding process leaks user data back to the bidder. Over time a bidder can collate it and merge it with other information to de-anonymize users and track them across the web. In some cases it can also set them up for targeting with surveillance software.
    • The ads appeared inside dozens of sensitive networks belonging to media organizations, governments and tech firms. At least one large US tech company and one international organization have opened internal inquiries into whether their employees were targeted.
    • Haaretz and Intelligence Online reported in May that Israeli-owned businesses were pitching clients on ways to identify and track Starlink users, with ad data appearing to play a key role.
    • Reuters reports TrendAI researchers wanted to name Discover-Tech but dropped the idea after executives raised legal concerns.

    Remediation

    The article gives no formal remediation. Organizations with staff in sensitive locations or using Starlink may review ad-tech exposure and check whether Discover-Tech-linked ads reached their networks. Ad platforms have removed Discover-Tech.

  2. gbhackers.com ↗ · pub. 28/10/2026 02:08 · coletado 28/10 03:00 primeiro registro

    SHADOW-EARTH-79 abuses real-time ad bidding to profile Starlink users and track individuals across 49 countries

    ler a análise desta fonte

    TrendAI researchers identified an operation tracked as SHADOW-EARTH-79 that abuses the real-time bidding (RTB) advertising ecosystem for what appears to be surveillance and intelligence gathering rather than marketing. It was the largest winning bidder in 49 countries and dominated Starlink advertising traffic in 105 countries. It bought 66,208 Starlink impressions over 90 days, or 12.9% of observed Starlink impressions against a 2.6% baseline (a 4.9-fold increase in interest, not in confirmed victims). TrendAI assesses with moderate to high confidence that the activity is targeting and tracking infrastructure. The findings describe traffic categories and do not represent confirmed victim counts.

    Technical Details

    • RTB bid requests can expose IP addresses, geolocation, autonomous system numbers and device characteristics to competing bidders. Combined with advertising identifiers, click records and location histories, this enables detailed behavioral profiles without user interaction.
    • Winning bidders deliver ad content that may include JavaScript capable of further data collection, such as movement profiling, device fingerprinting and interest analysis. The research does not confirm that every impression delivered malicious code or compromised a device.
    • Researchers used AI-assisted analysis to reconstruct the operator's application from exposed JavaScript bundles and infrastructure artifacts. The recovered interface showed manual script injection, de-anonymization and advanced IP filtering.
    • The operation captured 91.1% of observed bids in Hungary, 90.1% in Israel and 77.2% in Egypt. It also made purchases in conflict-affected markets where commercial motivation seemed questionable.
    • The dataset covers 84,710,348 requests from 2025-12-31 to 2026-08-15, with 154 buyer seats and 232 country classifications. Visibility was limited to one demand-side platform, and IP geolocation uncertainty affected some Starlink country assignments.

    Remediation

    • Restrict advertising traffic on sensitive devices and networks, limit ad-supported apps, disable ad personalization, review app permissions and reset advertising identifiers. These measures reduce exposure but do not guarantee protection.
    • Block connections to advertising backends or strip ad tags before data leaves the device. Merely hiding ads can leave tracking requests intact.
    • For high-risk personnel, combine network filtering, restrictive permissions and device protection modes. Investigate suspicious bidders and block identified surveillance infrastructure where feasible.