Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus

There have already been reports on code-signed rootkits like Netfilter, FiveSys, and Fire Chili. These rootkits are usually signed with stolen certificates or are falsely validated. However, when a legitimate driver is used as a rootkit, that’s a different story. Such is the case of mhyprot2.sys, a vulnerable anti-cheat driver for the popular role-playing game Genshin Impact. The driver is currently being abused by a ransomware actor to kill antivirus processes and services for mass-deploying ransomware. Trend Micro published a detailed analysis. Nobody should be too surprised: a public proof of concept has shown since October 2020 that the driver lets a user-mode process read and write kernel memory and kill processes with ZwTerminateProcess in ring 0.