Hackers abuse Genshin Impact anti-cheat file to deploy ransomware: Researchers

According to Trend Micro researchers, attackers are targeting Windows users of the game. When you install the game on Windows, the anti-cheat file works as a device driver and also authorises kernel-level authorization within your computer. Following this, the threat actor can pass on ransomware and infect your computer by encrypting all your files and gaining access to your sensitive information.

What makes the infected anti-cheat file unique is that it runs a fake AVG antivirus, and that’s how it enters your system. It then dumps various files as ransomware. As per researchers, the ransomware also has the power to shut all the antivirus from detecting it, including the likes of 360 Total Security.

Researchers note that organizations and security teams should be careful because of several factors—it can encrypt all your system files, and even deploy the ransomware to other PCs if you’re connected to multiple networks. “Ransomware operators are continuously looking for ways to covertly deploy their malware onto users’ devices. Using popular games or other sources of entertainment is an effective way of baiting victims into downloading dangerous files. It is important for enterprises and organizations to monitor what software is being deployed onto their machines or have the proper solutions in place that can prevent an infection from happening,” Trend Micro Researchers wrote in a blog post.

Going forward, users who are still using Genshin Impact should be careful with all the files that they download and update the latest patch released by the game.