Obstinate Mogwai

Obstinate Mogwai is a threat actor tracked in connection with compromises of exposed enterprise infrastructure, including a Microsoft Exchange server that was later found to host tooling from multiple intrusion sets simultaneously. The actor is associated with the Donnect malware family. In observed intrusions, Donnect was present alongside other malware attributed to separate groups, indicating either shared access to already-compromised systems or overlapping operations on the same victim environment. Obstinate Mogwai has been identified in the context of an intrusion affecting a government-sector organization in Russia, where investigators found evidence of multiple advanced threat groups operating on the same network. The compromised Exchange server had been exploited via the ProxyShell vulnerability chain, after which several malware families were deployed by different actors. For Obstinate Mogwai, the directly supported linkage is the presence of Donnect on the compromised server during the period of the actor’s suspected activity. Based on the available facts, Obstinate Mogwai demonstrates initial-access capability through exploitation of internet-exposed server infrastructure, as well as persistence and post-exploitation through deployment of malware on compromised hosts. The currently available information does not support a high-confidence assessment of the actor’s country of origin, broader victimology, or dominant motivation.