As reported by SecurityAffairs, researchers at TrendAI (a Trend Micro unit) have uncovered what appears to be a systematic ad tech surveillance campaign targeting SpaceX Starlink users — with an Israeli company called Discover-Tech identified as the top ad bidder across more than 100 countries, accounting for roughly 13% of all winning bid events in Starlink traffic.

This story is significant not because the technique is novel, but because of who is being targeted and why. Starlink is not ordinary consumer internet. It is the communication backbone for militaries, journalists, aid workers, and dissidents operating in conflict zones and censorship-heavy regions where terrestrial networks are degraded, destroyed, or monitored. Ukraine's frontline forces rely on it for drone coordination. When ad infrastructure is weaponized to geolocate those users, the stakes are life and death.

Why This Matters Beyond Starlink

The TrendAI findings expose a broader truth that defenders have been slow to internalize: the real-time bidding (RTB) advertising ecosystem is a surveillance pipeline that any well-funded actor can rent. You do not need a zero-day or nation-state toolkit. You need an ad buying budget and a demand-side platform.

RTB auctions transmit device identifiers, IP addresses, precise GPS coordinates, and app data to dozens or hundreds of bidders per impression. That data is logged, aggregated, and resold. For an actor whose goal is geolocating individuals in sensitive areas, this is a turnkey intelligence collection platform hiding in plain sight.

The threat here is not a vulnerability in Starlink. It is that the ad tech ecosystem freely sells the location data of anyone — including warzone users — to the highest bidder with virtually no vetting.

The Threat Actor Profile

TrendAI tracks this activity cluster as SHADOW-EARTH-79. The actor's bidding behavior is anomalous: winning bid rates five times higher than average high-volume buyers, concentrated specifically in Starlink traffic, and spanning countries where Starlink itself is banned or restricted. That concentration pattern is the tell — no legitimate advertiser targets only satellite internet users across 105 countries, including restricted markets.

Who Is at Risk

Why This Matters Beyond Starlink
Military and defense personnel using Starlink for tactical communications in active conflict zones
Journalists and humanitarian workers operating in hostile or surveillance-heavy environments
Dissidents and activists in authoritarian states using Starlink to bypass national internet controls
Any organization whose personnel use satellite internet in regions where physical location disclosure creates personal safety risk

Shield53 Recommendations

Defenders should treat ad-based location surveillance as an active, present threat — not a theoretical concern.

  • Deploy content blockers on managed devices: Enforce DNS-level ad blocking (e.g., Pi-hole, NextDNS, or enterprise equivalent) on all devices used in sensitive deployments. If ads never load, the RTB beacon never fires.
  • Isolate Starlink and satellite uplinks: Route satellite internet traffic through a VPN or proxy that masks the real client IP before it reaches ad networks. This breaks the correlation between the Starlink egress IP and the user's true location.
  • Restrict ad SDKs and trackers: On mobile devices used in operational contexts, disable ad personalization, revoke location permissions for non-essential apps, and deploy MDM policies that block known ad/tracking domains.
  • Monitor for anomalous ad traffic: Network defenders should log and alert on outbound connections to known RTB endpoints and demand-side platforms, especially from satellite-connected network segments. Unusual volumes may indicate targeting.
  • Brief at-risk personnel: Anyone using satellite internet in a conflict or high-risk zone should understand that their connection itself is a signal. Assume location data is being collected by multiple parties through ad infrastructure.
  • Audit your own ad tech exposure: Organizations running digital ad campaigns should verify that their DSP and supply chain partners are not enabling this kind of surveillance. Demand transparency on where bids are placed and which audiences are targeted.

This case should be a wake-up call for policymakers as well. The RTB data pipeline has been flagged by privacy regulators for years, but the national security dimension — adversarial actors buying precise location data on military users through commercial ad markets — demands a response that goes beyond consumer privacy enforcement. The ad tech industry has built a surveillance marketplace that anyone can use, and until that changes, defenders must assume their users' locations are for sale.