Trend Micro researchers observed a ransomware infection in late July 2022 that involved a code-signed driver called “mhyprot2.sys”, which is used for anti-cheat functions in the video game Genshin Impact. The currently undisclosed ransomware abused this driver to bypass privileges and disable anti-virus software. A notable observation by researchers is that Genshin Impact does not need to be installed on a victim’s machine for this ransomware to be deployed, as the use of the driver is independent from the video game and can be integrated into any malware. Since the driver is code-signed, it can be installed on Windows machines without creating alerts often seen with unsigned drivers or applications. There have been two (2) proof-of-concept (POC) exploits publicly available on GitHub since 2020. These POC exploits contain “full details on how to read/write kernel memory with kernel mode privileges from user mode, enumerate threads, and terminate processes.” In the recent ransomware incident, researchers observed that the ransomware operators first transferred the driver to the victim’s desktop as well as a malicious executable “kill_svc.exe”, which installs the driver. Next, “avg.msi” is downloaded, which drops and executes four (4) files: “logon.bat” (which disables antivirus and other services), “HelpPane.exe” (which disguises as Microsoft Help and Support and also disables antivirus services), “mhyprot2.sys” (which is the vulnerable Genshin Impact anti-cheat driver), and “svchost.exe” (which is the ransomware payload). The researchers then observed the operators attempting and failing three (3) times to encrypt files on the victim machine but successfully disabling the antivirus services. Lastly, the actors loaded the driver, the ransomware, and the executable “kill_svc.exe” onto a network share for mass deployment. As of August 24, 2022, the code signing for “mhyprot2.sys” is still valid, and CTIX analysts will continue to monitor for advancements with this observed methodology as well as provide updates were applicable.