A suspected surveillance operation targets Starlink users.

Summary

By the N2K CyberWire staff

A suspected surveillance operation targets Starlink users.

TrendAI researchers have found that Israeli ad tech company Discover-Tech heavily targeted Starlink users as part of a surveillance operation, Reuters reports. Discover-Tech was the subject of a report by Citizen Lab earlier this month, where researchers found that the company’s targeted ads were used to infect devices at Al Jazeera with spyware. Sources familiar with TrendAI's research said Discover-Tech was the number-one bidder for advertising space on Starlink traffic in 105 countries.

TrendAI published a report on the activity on October 15th, but did not name Discover-Tech directly. The researchers attribute the activity to an “ad-tech entity” tracked as “SHADOW-EARTH-79,” which the sources say is TrendAI’s codename for Discover-Tech. TrendAI said this entity “accounts for approximately 13% of all winning bid events in Starlink traffic, five times higher than average (approximately 3%) bids for other bidders, and the highest of any high-volume buyer,” adding that “Starlink is widely used in conflict zones where terrestrial networks are degraded.”

SpaceX hasn’t commented on the findings.

Most DSPM solutions stop at visibility. Does yours?

As cloud environments continue to expand, sensitive data can become difficult to track, classify, and protect. Understanding the maturity of your Data Security Posture Management (DSPM) program is an important step toward reducing risk and strengthening data security outcomes. Thales helps organizations identify, prioritize, and reduce risk through integrated data protection and remediation. Learn more.

Ransomware gang begins leaking data on GMO customers.

Japanese internet giant GMO Internet Group has confirmed that a ransomware gang has begun leaking data belonging to customers, the Japan Times reports. The hackers say they will be leaking information from GMO account holders one by one until the company agrees to pay a $1 million ransom. GMO says it refuses to negotiate, and customers will be compensated for their losses.

On Tuesday morning, GMO told customers to back up their data and disconnect their systems from the internet in anticipation of widespread ransomware deployment. The hackers breached the company’s Onamae Desktop Cloud last week and may have planted malware on up to 26,739 customers' servers, BleepingComputer reports.

Authentication isn't enough. Control what every identity can do.

Your identities now include employees, vendors, machines, applications, workloads, and AI agents. See how Xage controls what every identity can access and what it can do, with just-in-time access, no standing privilege, and continuous control across critical infrastructure, data centers, and enterprise AI. Control every Identity.

Business news: Blackwall (formerly BotGuard) raises $100 million.

Estonian web traffic management and DDoS mitigation startup Blackwall (formerly BotGuard) has raised $100 million in a Series C round led by AVP, with participation from existing investors Dawn Capital, MMC Ventures, and Tera Ventures. The company says it “will use the investment to scale its global presence across the web traffic management market, establishing and expanding operations across 12 strategic regions spanning North America, Europe, Asia-Pacific and the Middle East.”

Where cyber leaders come together to turn challenges into action.

The Aspen Cyber Summit brings together leading voices from government, industry, and civil society to address the cybersecurity challenges shaping our future. Join senior leaders and experts in Washington, DC, for consequential conversations focused on moving beyond identifying risks to advancing actionable, cross-sector solutions.

Attacks, Threats, and Vulnerabilities

Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws (SecurityWeek) Tailscale is preparing a patch for Tailscale SSH flaws whose details went public over the weekend, before any fixes had been released.

Colmobil cyberattack exposes vulnerabilities in Israel’s connected-car ecosystem (CTech) The ransomware incident disrupted operations at Israel’s largest vehicle importer and led the Transport Ministry to disconnect it from vehicle-registration systems. The attack raises broader questions about the security of the digital infrastructure linking importers, manufacturers and modern vehicles.

Hackers now scanning systems for recently-patched Oracle flaw (BleepingComputer) Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability.

Legislation, Policy, and Regulation

The US Government Is Hiding a Secret Court Ruling About How It Spies on Americans (WIRED) Two US senators say the Trump administration is breaking the law by withholding the FISA court decision while it presses Congress to renew America’s most sweeping surveillance program.

Litigation, Investigation, and Law Enforcement

FBI seizes ‘bulletproof’ hosting site accused of facilitating child abuse, money laundering (The Record) The FBI seized the domain of a “bulletproof” hosting provider accused of facilitating a range of cybercrimes, including money laundering and the distribution of child sexual abuse material.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

[un]prompted II (Virtual and San Francisco, California, USA, Oct 27 - 29, 2026) [un]prompted is back for the second time, this October, in SF. Whether you’re a CISO Excel jockey or a researcher sniffing for the scent of bits, we see you as part of our wider AI security practitioner community. [un]prompted is an intimate, raw, and fun gathering for the professionals actually doing the work, from offense to threat hunting to program building to national policy. No fluff. No filler. Just sharp talks, real demos, and conversations that matter.

CyberSat 2026 Unclassified Program (Reston, Virginia, USA, Nov 2 - 3, 2026) Space systems now form the backbone of critical infrastructure – from energy grids to autonomous transportation. CyberSat is the only forum where the operators, officials, and engineers actively defending those systems meet for four days a year.

CyberSat 2026 Classified Program (Chantilly, Virginia, USA, Nov 4 - 5, 2026) Space systems now form the backbone of critical infrastructure – from energy grids to autonomous transportation. CyberSat is the only forum where the operators, officials, and engineers actively defending those systems meet for four days a year.

CyberMarketingCon 2026 (Austin, Texas, USA, Nov 15 - 18, 2026) A conference for cybersecurity GTM leaders and doers. Cybersecurity marketing is specific, often technical, and constantly changing. Stay up-to-date with the latest in marketing in the cybersecurity industry while networking with your peers.

NATO Edge 26 (Fuar İzmir, Turkey, Nov 17 - 19, 2026) In a world where speed, scale, and resilience define defence, NATO Edge 26 brings together NATO, Allies, and industry to deliver the capabilities our Alliance demands. Faster, smarter, and together. This is not just another conference. NATO Edge 26 introduces a new, more interactive and mission-driven format placing industry in the forefront to foster practical cooperation, accelerate delivery, and strengthen readiness across the defence and technology spectrum.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.

Daily Briefing for 10.28.26

Top stories.

A suspected surveillance operation targets Starlink users.

Ransomware gang begins leaking data on GMO customers.

Business news: Blackwall (formerly BotGuard) raises $100 million.

Attacks, Threats, and Vulnerabilities

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Events