Actor Profile

BengalSEO is a financially motivated campaign operating from Rajasthan, India since at least 2015. The operation is driven by IT service providers WeConnect Solutions LLC (formerly iConnect Soft Solutions LLC) and Garage2Global. While Garage2Global presents itself as a legitimate website design and SEO services provider, evidence indicates the company develops malicious web infrastructure for SEO poisoning campaigns. The campaign demonstrates extensive knowledge of black hat SEO techniques and web development, utilizing these capabilities to manipulate search engine rankings and facilitate both malware distribution and tech support scams.

TTPs (Tactics, Techniques, Procedures)

BengalSEO employs sophisticated black hat SEO techniques including backlink manipulation, DOM injection, DOM shuffling, and keyword stuffing to poison Microsoft Bing search results. The campaign leverages user-generated content (UGC) spam at scale, flooding forums and comment sections with hyperlinks to lure pages. A traffic distribution system (TDS) acts as a gating mechanism, routing victims through redirector chains while employing Cloudflare Turnstile and hCaptcha challenges to evade automated analysis. Matomo analytics and Google Tag Manager are used for victim tracking and browser fingerprinting. The JavaScript-based MayaBot malware executes via wscript.exe to establish C2, enable system monitoring, and deploy XMRig cryptocurrency miners. The campaign also abuses legitimate hosting platforms including github.io, pages.dev, sites.google.com, and readthedocs.io for infrastructure.

Targets & Patterns

BengalSEO targets users searching for legitimate software and services on Microsoft Bing, specifically those seeking technical support, software downloads, and service activation. Lure pages impersonate technical support portals for streaming services, antivirus tools (notably Bitdefender), gaming software, taxation utilities, and activation pages for credit cards, healthcare services, and gift cards. The campaign also targets smart TV users (e.g., Vizio setup guides). Victims are selected based on their search behavior and browser fingerprinting, with the TDS filtering traffic to ensure only viable targets receive payloads or are redirected to scam call centers. The broad targeting suggests an opportunistic approach focused on high-volume traffic from users seeking common software and support resources.

Historical Context

BengalSEO has been operating since at least 2015, representing over a decade of continuous SEO poisoning activity. The campaign has deployed MayaBot malware since 2022, indicating an evolution from purely tech support scam operations to include malware distribution. Discovered by DFIR Report in March 2026, the campaign's longevity and scale are evidenced by extensive infrastructure: the Matomo tracking domain stats.us3[.]org appeared in 1,112 urlscan.io results at time of reporting, and individual lure pages like the Vizio decoy accumulated 2,000 backlinks across 167 unique external domains. The involvement of established Indian IT service providers suggests a persistent, organized operation with significant resources dedicated to maintaining and expanding the campaign infrastructure over time.

Defensive Recommendations

  • Monitor for wscript.exe executing JavaScript files from user-writable directories, particularly ZIP archives downloaded from suspicious domains (T1059.007 - JavaScript)
  • Implement web filtering to block known BengalSEO payload delivery domains (ustechnio[.]com, tax.dll[.]lat, u320[.]my, reficon[.]pro, pltechoo[.]pro) and the Matomo tracking domain stats.us3[.]org
  • Deploy detection rules for XMRig cryptocurrency miner indicators and unusual CPU utilization patterns associated with cryptomining activity (T1496 - Resource Hijacking)
  • Educate users on identifying fraudulent technical support pages and verify legitimate software download sources directly from vendor websites rather than search engine results
  • Monitor for DOM shuffling techniques and JavaScript-based obfuscation in web traffic, particularly from github.io, pages.dev, readthedocs.io, and sites.google.com subdomains that exhibit suspicious redirect chains

---

# Geopolitical Context

Geopolitical Context

BengalSEO represents a financially motivated cybercrime operation originating from Rajasthan, India, that has operated since at least 2015. The campaign leverages commercial IT service providers—WeConnect Solutions LLC and Garage2Global—to conduct large-scale SEO poisoning targeting Microsoft Bing search results. The operation's longevity and sophistication indicate a mature criminal ecosystem capable of sustaining complex technical infrastructure for malware distribution (MayaBot) and tech support fraud. The use of legitimate Indian IT firms as operational fronts highlights challenges in distinguishing between lawful digital marketing services and criminal cyber activity, particularly in jurisdictions with rapidly expanding technology sectors. The campaign's focus on financial gain through cryptocurrency mining and scam call centers aligns with broader trends in South Asian cybercrime, where technical expertise is leveraged for transnational fraud operations targeting primarily Western victims searching for software support and services.

State Actor Alignment

BengalSEO appears to be a purely criminal enterprise with no evident state sponsorship or strategic intelligence objectives. The actors operate openly through registered IT service companies in Rajasthan, suggesting either regulatory gaps or insufficient enforcement of cybercrime laws within India's domestic jurisdiction. There is no indication of alignment with Indian state interests; rather, the campaign represents opportunistic cybercrime exploiting India's IT services sector infrastructure. The operation's targeting is indiscriminate and financially motivated, lacking the geopolitical or espionage characteristics typical of state-aligned threat actors. India has faced international scrutiny regarding cybercrime originating from its territory, particularly tech support scams, and BengalSEO exemplifies the persistent challenge of policing criminal cyber operations embedded within legitimate business structures.

Business Impacty pro region

BengalSEO's primary impact extends beyond India to affect global internet users, particularly in English-speaking markets where victims search for software support via Bing. The campaign undermines trust in search engine results and legitimate IT service providers, potentially damaging India's reputation as a technology services hub. For Western nations, the operation highlights vulnerabilities in search engine security and the transnational nature of cybercrime, where perpetrators in one jurisdiction victimize users globally with limited accountability. The use of platforms like GitHub, Cloudflare, and ReadTheDocs demonstrates how globally accessible infrastructure can be weaponized for criminal purposes. European and North American law enforcement agencies may face jurisdictional challenges in pursuing prosecutions, requiring bilateral cooperation with Indian authorities. The campaign also underscores the need for enhanced private sector collaboration, as Microsoft (Bing), Cloudflare, and hosting providers play critical roles in either enabling or disrupting such operations through improved detection and takedown mechanisms.

Forecast

If Indian authorities do not enhance enforcement against cybercrime operations embedded within registered IT firms, similar campaigns leveraging India's technical workforce are likely to proliferate. Should Microsoft implement more robust SEO manipulation detection for Bing, BengalSEO may migrate to alternative search platforms or adapt techniques to evade new controls. If international pressure on India regarding tech support scams intensifies, regulatory scrutiny of firms like WeConnect and Garage2Global may increase, potentially disrupting current operations but likely displacing activity to less visible infrastructure. The continued profitability of cryptocurrency mining and fraud call centers suggests BengalSEO or successor operations will persist unless coordinated takedowns target both technical infrastructure and financial enablers. If hosting platforms strengthen abuse detection, threat actors may shift to more resilient or decentralized hosting solutions, complicating future mitigation efforts.