Loading threat actor…
SHADOW-EARTH-79 is the designation assigned by TrendAI to suspected advertising-based surveillance activity focused on users of SpaceX’s Starlink service. The activity has been publicly linked to the Israeli advertising company Discover-Tech. It exploits real-time bidding infrastructure to obtain device and network metadata associated with advertising opportunities. Correlating network information with persistent advertising identifiers can support user profiling and tracking across browsing sessions without requiring advertisement clicks. Within a study covering one advertising-buying platform, SHADOW-EARTH-79 was the leading winning bidder for observed Starlink advertising traffic in 105 countries, including Syria, Libya, Yemen, and South Sudan. It received 12.9% of observed Starlink advertising impressions, compared with 2.6% of impressions across overall traffic. Analysis of publicly available JavaScript revealed interface functionality for identifying users behind anonymous identifiers and manually inserting scripts, supporting an assessment that the infrastructure could serve intelligence-gathering purposes rather than ordinary advertising alone. The observed activity concerns potential misuse of advertising infrastructure, not an established compromise of Starlink’s satellites or network. Exposure to an associated advertisement does not establish device infection or individual tracking. The advertising measurements do not represent the entire market, and IP-derived geographic estimates have acknowledged limitations. No state sponsorship has been established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.