India-based BengalSEO group deploys MayaBot malware
The DFIR Report exposes BengalSEO, a Rajasthan, India-based scam operation using SEO poisoning and a traffic distribution system to deliver custom MayaBot malware and run tech support scams.
Sourcethedfirreport.com — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The DFIR Report has published the first part of a multi-part investigation into BengalSEO, a financially motivated scam operation attributed with high confidence to a cluster of individuals and IT service companies (notably WeConnect Solutions LLC and Garage2Global) based in Kota, Rajasthan, India. Active since at least 2015, the group uses extensive black-hat SEO expertise—backlink spam, DOM injection, keyword stuffing, and DOM shuffling—to promote lure pages impersonating tech support, antivirus, tax, streaming, and financial/healthcare card activation portals to the top of search results. Victims are funneled through a sophisticated Traffic Distribution System (TDS) using rotating redirector domains, Cloudflare Turnstile/hCaptcha bot-filtering, and a shared Matomo analytics instance for tracking and fingerprinting, ultimately leading either to a custom malware payload (a JavaScript dropper masquerading as an executable inside a ZIP, delivering the group's bespoke 'MayaBot' malware since 2022) or to a scam call center number.
The DFIR Report's research, built through GitHub OSINT, VirusTotal, Validin, and urlscan.io pivoting, uncovered hundreds of domains and SSL certificates tied to the operation, heavy reliance on Spaceship/Namecheap registrars and Hostmaza hosting behind Cloudflare, and a marked scale-up in bulk domain registration from August 2025 onward. The group maintains redundant infrastructure (e.g., wapp.live, aol.cx, iconnectpc.com subdomain clusters) and rotates redirectors via frequent GitHub commits to evade takedowns and detection, while corporate fronts (Garage2Global, WeConnect) blend legitimate web development work with malicious lure-page development.
For defenders, this represents a widespread, long-running SEO-poisoning-to-malware and tech-support-scam pipeline rather than a single targeted intrusion. Detection opportunities include monitoring for the identified redirector/payload domains, the shared Matomo endpoint (stats.us3[.]org/matomo.php), typosquatted CDN domains used for DOM injection, and JavaScript droppers executed via wscript.exe following ZIP downloads from search-result lure pages.
Mentioned in this report
Detection guidance
JavaScript Dropper Executed via Windows Script Host
A behavioural hunt for the technique in general.
wscript.exe or cscript.exe executing a JavaScript file from a user-controlled directory (Downloads, temp, Desktop) - typical of malware delivery via ZIP downloads from compromised search results. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: JavaScript Dropper Executed via Windows Script Host
description: Detects wscript.exe or cscript.exe spawning to execute JavaScript files
from user-writable locations, consistent with BengalSEO's ZIP-delivered JavaScript
dropper pattern.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \wscript.exe
- \cscript.exe
CommandLine|contains:
- .js
- .jse
selection_path:
CommandLine|contains:
- \Downloads\
- \Desktop\
- \AppData\Local\Temp\
- \Temp\
- \WINDOWS\Temp\
filter_admin:
User|contains:
- SYSTEM
- NETWORK SERVICE
condition: selection and selection_path and not filter_admin
falsepositives:
- Legitimate automation or configuration management scripts running from user temp
directories
- Software deployment tools executing JavaScript installers
level: high
id: 103679f8-c093-5e53-ae46-fce7b72b2406
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2026/08/24/bengalseo-part-1-anatomy-of-the-operation
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs