Loading story…
Denuvo’s anti-tamper protections have been significantly weakened by two parallel developments: a widely adopted hypervisor-based bypass that has enabled near zero-day piracy of protected PC games, and a reported full crack of Resident Evil: Requiem by voices38 that allegedly removes Denuvo entirely. The bypass has already been used across multiple newer titles, accelerating repacks on piracy sites, while the full crack is described as a more complete defeat that strips the DRM rather than merely spoofing its checks. Tom’s Hardware reported that the cracked build of Resident Evil: Requiem ran faster and used less VRAM and system memory than the bypassed version, with claims of roughly 5% higher FPS.
The hypervisor method has also raised serious security concerns because users have reportedly had to disable key Windows protections, including VBS, Credential Guard, Driver Signature Enforcement, and Core Isolation/Memory Integrity, before installing a community-made hypervisor operating at a privilege level above the OS. That setup could create opportunities for stealthy system compromise or exploitation of flaws in the hypervisor itself, prompting warnings even within piracy circles. Denuvo parent Irdeto said it is developing countermeasures and asserted that its response will not further degrade performance or require deeper operating-system access, but the emergence of more plug-and-play bypasses suggests the company is facing a broader erosion of its DRM model.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Tom's Hardware reported that Denuvo and 2K Games introduced mandatory online verification every 14 days in titles including NBA 2K25, NBA 2K26, and Marvel's Midnight Suns. The reported change appears intended to blunt the hypervisor-based bypass because it relies on live server communication that the bypass cannot emulate.
An upgraded version of the hypervisor-based Denuvo bypass was reported that may no longer require users to disable major Windows security protections, making the method easier to use. This marked a further escalation beyond the earlier cumbersome bypass approach.
A cracker identified as voices38 reportedly produced a full crack for Resident Evil: Requiem that disables or strips out Denuvo rather than merely bypassing its checks. The cracked build was reported to run faster and use less VRAM and system memory than the bypassed version.
In response to the spread of the hypervisor-based bypass, Irdeto, Denuvo's parent company, said it was working on countermeasures. The company stated the changes would not harm performance or require going deeper into the operating system.
A community-made hypervisor-based method for bypassing Denuvo DRM became broadly adopted in gaming and piracy circles, enabling protected games to be released and making zero-day repacks increasingly common. The technique reportedly required users to disable multiple Windows security protections before installation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
techdirt.com
Open sourcetomshardware.com
Open sourcetomshardware.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Austrian DRM vendor Denuvo filed suit in the U.S. District Court for the Northern District of California against the anonymous game cracker known as **voices38** and ten unnamed defendants. The complaint alleges that voices38 reverse-engineered and bypassed Denuvo Anti-Tamper protections in at least 26 PC games, enabling distribution of cracked copies, including through Reddit. Because Denuvo does not own the copyrights in the affected games, it alleges violations of the DMCA's anti-circumvention provisions rather than direct copyright infringement. Denuvo seeks damages and an injunction barring current and future bypass activity, and may request identifying records from Valve, Reddit, and Discord for accounts and seven Steam profiles it believes are linked to the defendant; the allegations have not yet been tested in court.
Sep 17, 2026
Fortinet disclosed two techniques that can let attackers load unsigned kernel drivers on Windows systems by tampering with **Driver Signature Enforcement (DSE)** at runtime, despite protections such as Code Integrity, PatchGuard, Virtualization-based Security, and Microsoft’s recommended vulnerable-driver block rules. The methods, dubbed **Page Swapping** and **Callback Swapping**, abuse kernel write access—often obtained through vulnerable third-party drivers—to redirect protected Code Integrity policy data or replace validation callbacks in `ntoskrnl.exe`, causing malicious drivers to be accepted as trusted. The report says Microsoft’s **Kernel Data Protection (KDP)** and driver blocklists raise the bar but do not fully stop runtime DSE tampering when **Hypervisor-protected Code Integrity (HVCI)** is not enabled, because driver validation can still be manipulated in the normal kernel. The findings build on a long history of DSE bypass tradecraft, including Turla-linked tooling such as **TDL**, a loader that mapped specially crafted unsigned drivers into kernel memory without modifying standard Code Integrity variables, underscoring how kernel-level access and vulnerable drivers remain a practical path to stealthy persistence and defense evasion on Windows.
Aug 15, 2026
Researchers from the University of Birmingham and Durham University disclosed **"Download More RAM,"** a software-only attack that rewrites writable SPD EEPROM data on certain DDR4 and DDR5 DIMMs over SMBus/I2C, causing memory to falsely report more capacity and creating aliased physical memory regions on Windows 11 systems. With **local administrator privileges**, an attacker can use the aliased region to read and write protected memory, patch Secure Kernel Code Integrity, and bypass defenses including **VBS**, **HVCI**, **DSE**, and **PatchGuard**; the technique was also shown disabling **Microsoft Defender** and **Sophos Intercept X**, modifying VBS enclaves, bypassing anti-cheat protections, and enabling blocked vulnerable drivers to load. Microsoft tracked the issue as **`CVE-2026-23670`** and shipped mitigations in its April 2026 security updates, including blocking the demonstrated stabilization method, disabling the `removememory` boot parameter on Secure Boot systems, and extending VBS protections to some systems without Secure Boot. The researchers said the mitigation is partial and that systems lacking Secure Boot may remain exposed if alternative stabilization methods are found. The affected hardware identified in the research includes consumer DIMM lines from **Corsair, G.Skill, and ADATA** with SPD write protection disabled.
Aug 17, 2026