HoYoverse knows about it, but they don’t.

The fact that hackers use Genshin Impact anti-cheat driver in their ransomware, Said Experts from Trend Micro. According to their research, attackers have been distributing such utilities since July 2022.

Hackers take advantage of the fact that the Chinese action RPG’s anti-cheat driver has a digital certificate from Microsoft, thereby gaining elevated privileges on Windows. Once attackers include the driver in their malware, they can also use it to disable antivirus.

Trend Micro emphasized that a successful attack does not require Genshin Impact to be installed on the victim’s computer. Ransomware with an integrated anti-cheat driver works on its own without using any other game files.

As of 2020, cybersecurity experts have expressed concern that Genshin Impact Anti-Cheat has many privileges, including at the Windows kernel level. HoYoverse only responded to the claims once and updated the anti-cheat so it turns off when the game isn’t working.

Trend Micro experts told HoYoverse about the ransomware they discovered, but the Chinese company did not comment on the situation.