BengalSEO Part 1: Anatomy of the Operation

MITRE Techniques

• [T1036 ] Masquerading – The group disguises fake support pages, fake software downloads, and a JavaScript dropper as legitimate tools or files [‘The lure pages mimic legitimate technical support and service activation portals’ / ‘Inside the ZIP file is a MayaBot JavaScript dropper masquerading as an exe file.’]
• [T1566 ] Phishing – Victims are lured through deceptive support and activation pages that push them toward scams or malicious downloads [‘mimic legitimate technical support and service activation portals’ / ‘trick victims into calling their scam call centers’]
• [T1583.001 ] Acquire Infrastructure: Domains – BengalSEO registers and uses large numbers of domains for redirectors, lure pages, landing pages, and payload hosting [‘Between 2023 and 2026, our team identified hundreds of domains and SSL certificates tied to BengalSEO.’]
• [T1583.006 ] Acquire Infrastructure: Web Services – The operation uses GitHub, pages.dev, github.io, readthedocs.io, and other web hosting services to publish lure infrastructure [‘BengalSEO utilizes page hosting platforms such as github.io, pages.dev. sites.google.com, and readthedocs.io.’]
• [T1587.001 ] Develop Capabilities: Malware – The group built a custom malware strain, MayaBot, to support scam operations [‘This includes deploying a custom malware strain our team has named MayaBot’]
• [T1027 ] Obfuscated Files or Information – JavaScript, URLs, and payloads are obfuscated or encoded to hide their purpose and evade detection [‘obfuscated ASCII character codes’ / ‘Base62 or base64 encoding’ / ‘Obfuscated MayaBot JavaScript dropper source’]
• [T1071.001 ] Application Layer Protocol: Web Protocols – The campaign uses HTTP GET/POST, redirects, and web-based tracking to move victims through the delivery chain [‘the redirector server issues an HTTP 302 redirect’ / ‘HTTP POST request to stats.us3[.]org/matomo.php’]
• [T1090.003 ] Proxy: Multi-hop Proxy – Traffic is routed through rotating redirector domains to hide final destinations and distribute victims [‘using a rotating network of redirector domains to route victims from lure pages to final landing pages’]
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – Captcha challenges and browser fingerprinting are used to filter out automated analysis and bots [‘deploy a Cloudflare Turnstile or hCaptcha challenge to filter out automated crawlers, scanners, and bots’]
• [T1057 ] Process Discovery – The payload execution path references wscript.exe, which executes the JavaScript dropper [‘the JavaScript executes via wscript.exe and initiates the Mayabot infection’]
• [T1204.002 ] User Execution: Malicious File – Victims are instructed to download and open a ZIP archive containing the malicious dropper [‘the victim begins downloading a ZIP archive’ / ‘prompted with instructions to open and execute the contents of the downloaded ZIP file’]
• [T1105 ] Ingress Tool Transfer – The lure-to-payload chain delivers malicious content from hosted landing pages to victim systems [‘deliver the MayaBot malware’ / ‘serving payloads to final landing pages’]
• [T1568.002 ] Dynamic Resolution: Domain Generation Algorithms – While not a classic DGA, the operation heavily rotates numbered and patterned domains across many TLDs to continually refresh infrastructure [‘bulk domains using numbered us, act, and pc naming conventions across .my, .shop, and .info TLDs’]