-
Two Israeli-owned companies, Targeteam and Rayzone, have developed tools to locate Starlink terminals and identify users.
-
Targeteam’s Stargetz tool tracked one million active terminals during a Vienna demonstration; it de-anonymized approximately 200,000 of them by linking smartphones to specific terminals and then to individual identities.
-
The technology relies on advertising identifiers from Apple and Google, which hundreds of ad exchanges worldwide trade alongside device coordinates; this creates a commercially accessible data stream that removes anonymity from satellite internet users.
Two Israeli-owned companies have developed technology capable of locating Starlink satellite terminals and identifying the people using them. The systems combine commercial data sources to strip away the anonymity that the satellite internet service typically provides.
Starlink, a subsidiary of Elon Musk’s SpaceX, operates a network of thousands of low-orbit satellites. The service has become a critical communication tool in conflict zones – including Ukraine, and has helped protesters bypass government internet shutdowns. However, the new Israeli technology threatens to expose users who rely on the system for privacy and security.
Companies Debut De-Anonymization Tools at European Intelligence Conference
The Israeli-Cypriot company Targeteam plans to unveil its Stargetz tool at the ISS World Europe conference in Prague this June. The system works alongside another company product called VPNz, which removes anonymity from virtual private network users. Together, these tools position Targeteam prominently in the emerging market for satellite communication intelligence.
A separate system from a company called Rayzone offers similar capabilities. According to the Haaretz investigation, Rayzone has long operated in this niche with a product named Echo. Both companies employ engineers with backgrounds in elite Israeli cyber units and military intelligence.
Targeteam operates with unusual secrecy. The company maintains no public website and instructs employees not to maintain active LinkedIn profiles. The firm holds offices in both Israel and Cyprus, which serves as a common base for Israeli cyber exporters.
Technology Does Not Hack Starlink but Fuses Commercial Data
Neither system actually breaks into Starlink’s encrypted communications or intercepts network traffic. Instead, the tools rely on a technique called data fusion, combining multiple commercially available information sources.
The method exploits the advertising technology ecosystem. Apple and Google assign unique advertising identifiers to every smartphone, known as IDFA and AAID, respectively. Hundreds of ad exchanges worldwide trade these identifiers alongside device location coordinates. This market generates tens of billions of dollars annually, and access remains commercially open.
A Starlink terminal reveals itself through its connection address and network signatures. Smartphones connected through that terminal leak their advertising identifiers and location data through various applications. By matching this information across time and space, the system ties a specific phone to a specific terminal, and it then links that phone to the owner’s identity through other data sources.
The result provides strategic intelligence on a global scale rather than tactical local detection. During a demonstration in Vienna, Stargetz tracked one million active terminals through which approximately 5.5 million devices were transmitting traffic. The system had successfully de-anonymized about 200,000 of those terminals; they linked the terminals to specific individuals or devices.
The map updates every six minutes, though it does not provide real-time location data. This delay likely represents the aggregation window for the adtech feeds the system consumes.
Technology Raises Privacy Concerns for Starlink Users Worldwide
A sales representative for Targeteam summarized the logic behind the tool in a pointed comment quoted by Haaretz. The representative stated that a ship might hide itself, but its crew still needs pornography and TikTok. A vessel with its transponder turned off becomes invisible to radar and identification systems, but a Starlink terminal on board and the crew’s smartphones reveal both location and affiliation.
Classical interception methods do not work against Starlink because the network consists of over 8,000 low-orbit satellites with ground gateways located outside target countries. No physical point exists where an attacker can tap into the infrastructure.
The two Israeli systems fill this gap using a method completely unrelated to signals intelligence. They represent strategic tools sold to governments as a service, rather than tactical weapons for local deployment.
For Starlink users, countering this technology requires preventing any smartphone or tablet with active advertising identifiers and installed applications from using the satellite connection. However, in real-world Starlink deployments, almost no users take this precaution.
The exposure of Apple and Google user data is a recurring theme in cybersecurity. An alleged leak of stealer logs claims to have compromised data from both tech giants, alongside dozens of other global firms, proving that user identifiers are under constant assault from multiple angles.
