Loading threat actor…
DenuvOwO is a game-DRM circumvention developer associated with the MKDev collective. The group developed a hypervisor-based bypass for Irdeto’s Denuvo Anti-Tamper DRM that uses a kernel-level driver to interfere with Denuvo checks while leaving the DRM components present. DenuvOwO’s bypassed game releases were circulated through piracy forums. The group reportedly disbanded following legal action by Irdeto against another alleged Denuvo-circumvention developer, Voices38.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A game-DRM circumvention group reportedly disbanded after developing and distributing a hypervisor-based bypass for Denuvo Anti-Tamper. The bypass disables system-level protections and was based on common open-source computing tools.
Associated with development of a hypervisor-based bypass used to defeat Denuvo DRM protections.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.