Obstinate Mogwai

Obstinate Mogwai is an Asian advanced persistent threat group identified by Solar 4RAYS during an investigation into the compromise of a Russian telecommunications company in late 2023. Its presence was also identified in a government organization's compromised infrastructure in 2025. Its specific country of origin, state affiliation, and relationship to established APT groups have not been reliably established. Donnect malware is associated with the group. Obstinate Mogwai exploits ASP.NET VIEWSTATE deserialization on Microsoft Exchange servers using compromised application validation keys. This technique enabled repeated access after responders removed externally accessible web shells. Its custom VIEWSTATE Exploitation Framework uses standard ysoserial gadgets to load .NET assemblies into Exchange worker-process memory, submitting a separate assembly-bearing request for each action. The framework supports PowerShell execution without launching a separate PowerShell process, file and directory inspection, and file exfiltration. The group has stolen mailbox contents and other data through compromised Exchange servers. Observed activity includes account enumeration, directory discovery, registry queries, connectivity checks, DNS resolution, additional tool deployment, and file deletion. The group also uses obfuscated PowerShell to decrypt and load a .NET backdoor into memory. Memory-resident execution and encrypted command inputs and responses reduce exposure to disk-based detection. Obstinate Mogwai is tracked separately from Erudite Mogwai, also known as Space Pirates; their presence in the same victim environments does not establish a shared identity or operational relationship.