Kernel-level anti-cheat software has quietly become one of PC gaming's biggest attack surfaces

Kernel-level anti-cheat software now runs with the same privileges as your antivirus engine on tens of millions of PCs, and that access has become one of the most exploitable surfaces in consumer computing. Riot Games’ Vanguard, Easy Anti-Cheat (EAC), BattlEye, and Denuvo Anti-Cheat all load a signed driver into Windows’ kernel ring 0 — the same privilege level as the OS itself — to catch memory-manipulation cheats that user-mode tools cannot see. The problem is that a driver trusted enough to inspect every process in memory is also trusted enough to disable security tooling, and attackers have been quietly weaponizing that trust since at least 2022.

This is not a hypothetical. Security researchers and Microsoft’s own Vulnerable Driver Blocklist (VBL) have repeatedly flagged signed anti-cheat and gaming drivers as a “bring your own vulnerable driver” (BYOVD) vector — attackers load a legitimately signed driver with a known flaw, then use the kernel access it grants to kill EDR processes before deploying ransomware. The pattern has shown up in incidents tied to BlackByte and other ransomware crews, who favored vulnerable drivers specifically because they carry a valid Microsoft signature and sail past code-signing checks that would block an unsigned kernel module outright.

How a Trusted Driver Becomes a Weapon

The underlying mechanic is simple. Windows requires kernel-mode drivers to be signed, either directly by Microsoft or through the WHQL (Windows Hardware Quality Labs) program, to prevent arbitrary code from running at the highest privilege level. Anti-cheat vendors need that level of access to read opponent processes’ memory, hook system calls, and detect debuggers — all things a cheat-maker’s user-mode process would otherwise hide from. So the vendor gets a legitimately signed driver installed on every machine that runs the game.

If that driver has a bug — an exposed IOCTL handler that lets any process on the machine send it commands, for instance — an attacker doesn’t need their own malicious driver at all. They load the already-signed, already-trusted anti-cheat driver, talk to its exposed interface, and use its kernel privileges to terminate protected processes, including EDR agents from CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint. This is exactly what happened with miHoYo’s mhyprot2.sys driver, originally shipped with Genshin Impact’s anti-cheat system: it exposed functions that let any local process terminate arbitrary other processes, and ransomware operators adopted it specifically because it was a clean, signed binary with no obvious malware signature.

The Scale Problem

Capcom’s anti-cheat driver had a similar arbitrary-process-termination flaw disclosed in 2020. Genshin Impact’s driver remained installed and running on some systems even after the game itself was uninstalled, because the install routine never provided an uninstaller for the kernel component — a detail that only came to wider attention once security researchers started mapping which “LOLDrivers” (living-off-the-land drivers) ransomware groups were cataloguing for reuse. Microsoft’s VBL, which ships via Windows Update and App Control for Business, now blocks dozens of specific anti-cheat and gaming-utility driver versions by hash, but the blocklist is reactive: a driver has to be caught in the wild being abused before it gets added, and new anti-cheat driver versions ship constantly as vendors patch bypasses.

The scale here matters more than any single incident. Valorant alone has well over 20 million monthly active players, and Vanguard installs at boot time, before the OS user-interface loads, specifically so cheat tools can’t disable it mid-session. EAC and BattlEye combined cover hundreds of competitive titles. That is a kernel-privileged binary, controlled by a third-party vendor rather than the OS maker, sitting on an enormous installed base — and unlike an antivirus vendor, most anti-cheat vendors have never gone through the kind of adversarial security auditing that EDR products routinely face, because their threat model was built around catching cheaters, not resisting nation-state-grade driver exploitation research.

Why This Keeps Recurring

Anti-cheat vendors face a structural incentive problem: every new kernel capability they add to catch a more sophisticated cheat is also a new capability an attacker can abuse, but the vendor’s KPI is cheat-detection rate, not attack-surface minimization. Rewriting these systems to run in user mode with narrower capabilities — the direction Valve has pushed with VAC’s largely user-mode design for Steam, accepting a lower cheat-detection ceiling in exchange for a dramatically smaller kernel footprint — is a real trade-off that most publishers have been unwilling to make, because competitive-integrity complaints move review scores and player counts faster than a theoretical driver CVE does.

Microsoft has also been pushing vendors toward its Kernel-Mode Hardware-Enforced Stack Protection and HVCI (Hypervisor-Protected Code Integrity) frameworks, which constrain what a kernel driver can do even with valid code signing, but adoption is opt-in and slow because it can break anti-cheat detection logic that depends on broad memory visibility. Until HVCI-style containment becomes mandatory rather than optional, the signed-driver trust model that makes anti-cheat work is the same one that makes it a durable BYOVD target.

What To Actually Do About It

For IT administrators managing fleets that run competitive games — common in gaming cafes, esports orgs, and even general-purpose corporate images where employees have local admin rights — the practical move is to keep Microsoft’s VBL enabled and current rather than disabling it for compatibility reasons, since that blocklist is the main mechanism actively removing known-abusable gaming drivers. Enterprise EDR deployments should specifically monitor for anti-cheat driver load events outside of expected gaming processes; a Vanguard or EAC driver loading on a server or a workstation with no matching game installed is a strong signal worth investigating on its own.

For players, the realistic takeaway is narrower: uninstalling a competitive game doesn’t always remove its kernel driver, so checking Windows’ installed drivers list (via driverquery in an elevated terminal) after uninstalling anti-cheat-protected titles is worth the thirty seconds it takes. For publishers still deciding how to build the next generation of anti-cheat, the Valve VAC trade-off is the one worth studying seriously: a detection system with a lower ceiling but a kernel footprint small enough that it stops being a ransomware crew’s favorite signed driver to borrow.