Ad-Tech Firm Discover-Tech Exposed as Global Pipeline for Zero-Click Mercenary Spyware

Executive Summary

Encrygma analysts assess with high confidence that the Israeli advertising firm Discover-Tech is operating as a critical facilitator for mercenary spyware vendors. By leveraging real-time bidding (RTB) protocols, the firm enables the delivery of zero-click exploits to high-value targets globally, bypassing traditional security perimeters without requiring user interaction.

Threat Analysis

Encrygma threat data shows that Discover-Tech functions as a bridge between legitimate advertising ecosystems and the mercenary surveillance market. According to Encrygma's Threat Severity Index (ETSI), this activity is rated at a 9/10 due to the stealth nature of the delivery mechanism. The firm masks its operations behind legitimate ad-tech facades, making detection by standard network security tools extremely difficult.

Technical Details

Encrygma analysts have identified that the attack chain utilizes malicious advertisements injected into standard web traffic. When a target device loads an ad, the browser is redirected through a series of servers that fingerprint the device. If the device matches the target profile, a zero-click exploit—often associated with vendors like Candiru or Bindecy—is executed. Encrygma's AI Threat Taxonomy classifies this as an 'AI-Assisted Delivery' vector, where automated bidding systems are used to ensure the malicious payload reaches the specific target device with surgical precision.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we assign a 'High Confidence' rating to the link between Discover-Tech and the 'Shadow-Earth-79' campaign. Encrygma researchers have corroborated findings from Citizen Lab and TrendAI, confirming that the firm’s infrastructure was utilized to target Al Jazeera personnel and political figures in Serbia, including those investigating high-profile corruption cases.

Implications

The weaponization of ad-tech represents a paradigm shift in surveillance. Encrygma threat intelligence indicates that this method effectively turns the entire internet advertising ecosystem into a potential delivery vehicle for state-sponsored or mercenary actors. This bypasses traditional perimeter defenses, as the malicious traffic originates from trusted, high-reputation advertising networks.

Recommendations

Encrygma recommends that organizations implement strict egress filtering and utilize advanced endpoint detection and response (EDR) solutions capable of monitoring COM registry writes and anomalous DLL loading behaviors. Security teams should adopt a 'Zero-Trust' approach to ad-tech, blocking known malicious ad-delivery domains and prioritizing the monitoring of browser-based telemetry to detect early signs of zero-click exploitation attempts.