Obstinate Mogwai

Obstinate Mogwai is a threat actor identified in Rostelecom security team reporting as one of at least three APT groups present on the network of a Russian organization, alongside Erudite Mogwai (Space Pirates) and GOFFEE. In the cited investigation, multiple malware families were found co-resident on a Microsoft Exchange server that had been compromised in summer 2024 via the ProxyShell vulnerability chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207). The content directly attributes the Donnect malware family to Obstinate Mogwai, and notes that a new sample was deployed during the period of presumed Obstinate Mogwai activity. No additional aliases beyond “obstinate_mogwai” / “Obstinate Mogwai” are provided in the content. The available content does not directly state the actor’s country of origin, specific targets beyond presence in a Russian organization investigation, or broader TTPs beyond the association with Donnect and activity on the compromised Exchange infrastructure.