Loading threat actor…
Discover-Tech, also known as DTech, is an Israeli advertising-technology company that facilitates mercenary surveillance and spyware delivery through advertising infrastructure. Registered in 2020, it has facilitated mercenary spyware operations since at least 2024. Its partners include Candiru, while technical and organizational connections also link it to Intelos, Bindecy, Adtimizer, and Tekma. These entities are not established aliases or subgroups. Discover-Tech operates Controlium, a platform enabling surveillance partners to deanonymize, fingerprint, and automatically infect devices when advertisements are rendered. Its advertising infrastructure supports AdFection, a zero-click delivery mechanism that does not require interaction with an advertisement. At least 45 Al Jazeera devices were targeted in attacks linked with high confidence to Candiru spyware delivered through Discover-Tech advertisements. The specific party operating those attacks has not been established. Its advertisements use hidden frames, obfuscated JavaScript, sophisticated cloaking, and encrypted communications to hand devices to Candiru-attributed infrastructure. Associated staging components collect detailed browser and device characteristics, monitor interaction signals, and execute operator-supplied JavaScript within their execution context. This supports selective target evaluation and payload delivery; it does not itself demonstrate a browser sandbox escape. A complete exploit chain was not captured during Confiant's investigation. Discover-Tech also collects readable first-party publisher cookies, including authenticated session identifiers and personal information, and transmits them with device profiles and advertising identifiers. Its identity-matching infrastructure provides extensive surveillance reach across websites and applications. Although its advertisements have appeared on sensitive government, defense, healthcare, and other institutional networks, advertisement exposure alone does not establish deliberate targeting or compromise of those institutions. DARK CARTOGRAPHER is a separate actor that uses Discover-Tech infrastructure, not an established Discover-Tech alias.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
19 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operates advertising infrastructure used for large-scale identity collection and selective delivery of Candiru-attributed JavaScript staging payloads. The report estimates roughly 10 million daily ad impressions, alongside billions of monthly cookie-matching touchpoints. Its creatives collect device profiles and, where browser context permits, publishers' first-party cookies, including authenticated session identifiers and personal information. Geographic and device-specific campaigns suggest deliberate targeting, while the Candiru handoffs involve much smaller volumes consistent with micro-targeting. Ads also reached sensitive institutional networks, but that alone does not establish intentional targeting of those institutions or their users. No complete exploit chain was captured.
An Israeli company described as facilitating mercenary surveillance through targeted advertising. Researchers linked its advertisements to zero-click Candiru spyware attacks against at least 45 Al Jazeera devices. Its Controlium platform reportedly enables surveillance partners to identify, fingerprint and automatically infect devices when advertisements render. The ultimate operators behind the AdFection attacks remain unattributed.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.