VORANT. Threat Intelligence Sign in Get the full feed

India-based BengalSEO group deploys MayaBot malware

routine threat financial-serviceshealthcaretechnologymedia

The DFIR Report exposes BengalSEO, a Rajasthan, India-based scam operation using SEO poisoning and a traffic distribution system to deliver custom MayaBot malware and run tech support scams.

The DFIR Report has published the first part of a multi-part investigation into BengalSEO, a financially motivated scam operation attributed with high confidence to a cluster of individuals and IT service companies (notably WeConnect Solutions LLC and Garage2Global) based in Kota, Rajasthan, India. Active since at least 2015, the group uses extensive black-hat SEO expertise—backlink spam, DOM injection, keyword stuffing, and DOM shuffling—to promote lure pages impersonating tech support, antivirus, tax, streaming, and financial/healthcare card activation portals to the top of search results. Victims are funneled through a sophisticated Traffic Distribution System (TDS) using rotating redirector domains, Cloudflare Turnstile/hCaptcha bot-filtering, and a shared Matomo analytics instance for tracking and fingerprinting, ultimately leading either to a custom malware payload (a JavaScript dropper masquerading as an executable inside a ZIP, delivering the group's bespoke 'MayaBot' malware since 2022) or to a scam call center number.

The DFIR Report's research, built through GitHub OSINT, VirusTotal, Validin, and urlscan.io pivoting, uncovered hundreds of domains and SSL certificates tied to the operation, heavy reliance on Spaceship/Namecheap registrars and Hostmaza hosting behind Cloudflare, and a marked scale-up in bulk domain registration from August 2025 onward. The group maintains redundant infrastructure (e.g., wapp.live, aol.cx, iconnectpc.com subdomain clusters) and rotates redirectors via frequent GitHub commits to evade takedowns and detection, while corporate fronts (Garage2Global, WeConnect) blend legitimate web development work with malicious lure-page development.

For defenders, this represents a widespread, long-running SEO-poisoning-to-malware and tech-support-scam pipeline rather than a single targeted intrusion. Detection opportunities include monitoring for the identified redirector/payload domains, the shared Matomo endpoint (stats.us3[.]org/matomo.php), typosquatted CDN domains used for DOM injection, and JavaScript droppers executed via wscript.exe following ZIP downloads from search-result lure pages.

Mentioned in this report

Threat actors BengalSEO
Malware MayaBot

Detection guidance

JavaScript Dropper Executed via Windows Script Host

ATT&CK T1204.002

wscript.exe or cscript.exe executing a JavaScript file from a user-controlled directory (Downloads, temp, Desktop) - typical of malware delivery via ZIP downloads from compromised search results. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: JavaScript Dropper Executed via Windows Script Host
description: Detects wscript.exe or cscript.exe spawning to execute JavaScript files
  from user-writable locations, consistent with BengalSEO's ZIP-delivered JavaScript
  dropper pattern.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \wscript.exe
    - \cscript.exe
    CommandLine|contains:
    - .js
    - .jse
  selection_path:
    CommandLine|contains:
    - \Downloads\
    - \Desktop\
    - \AppData\Local\Temp\
    - \Temp\
    - \WINDOWS\Temp\
  filter_admin:
    User|contains:
    - SYSTEM
    - NETWORK SERVICE
  condition: selection and selection_path and not filter_admin
falsepositives:
- Legitimate automation or configuration management scripts running from user temp
  directories
- Software deployment tools executing JavaScript installers
level: high
id: 103679f8-c093-5e53-ae46-fce7b72b2406
status: experimental
author: Vorant

Web Request to Known Malware Distribution or Analytics Tracking Domain

ATT&CK T1608.005

HTTP/HTTPS requests to infrastructure associated with BengalSEO malware delivery or tracking, including shared Matomo analytics endpoint (stats.us3[.]org/matomo.php) and payload distribution redirectors. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Request to Known Malware Distribution or Analytics Tracking Domain
description: Detects outbound HTTP/HTTPS connections to BengalSEO's shared Matomo
  analytics instance or known malware distribution redirector infrastructure used
  for fingerprinting victims and delivering payloads.
tags:
- attack.command-and-control
- attack.t1608.005
logsource:
  category: network_connection
  product: windows
detection:
  selection_matomo:
    DestinationHostname|contains:
    - stats.us3.org
    DestinationPort:
    - 80
    - 443
    CommandLine|contains: matomo.php
  selection_redirector_patterns:
    DestinationHostname|contains:
    - wapp.live
    - aol.cx
    - iconnectpc.com
    Image|endswith:
    - \chrome.exe
    - \firefox.exe
    - \iexplore.exe
    - \msedge.exe
  filter_legitimate_analytics:
    User|contains:
    - SYSTEM
    - Administrator
    Image|endswith:
    - \winlogon.exe
    - \services.exe
  condition: (selection_matomo or selection_redirector_patterns) and not filter_legitimate_analytics
falsepositives:
- Legitimate Matomo deployments on internal or third-party analytics services
- Employees browsing legitimate .live or .cx domains
level: high
id: 6c0a13f1-31ab-51d0-9c96-a4a5d121ad5c
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://thedfirreport.com/2026/08/24/bengalseo-part-1-anatomy-of-the-operation

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free