Honkai: Star Rail

Honkai: Star Rail is HoYoversePublisherHoYoverse / miHoYomiHoYo (mainland China), publishing internationally as HoYoverse via Cognosphere, makes Genshin Impact, Honkai: Star Rail, and Zenless Zone Zero. Its legacy anti-cheat driver mhyprot2.sys became a landmark security case after ransomware crews abused the signed driver to disable antivirus; its current games ship a newer driver, HoYoKProtect.sys.3 games in this family →'s free-to-play turn-based gacha RPG, developed by miHoYo and released April 26, 2023 on Windows, iOS, and Android, with a PlayStation 5 version later that year. Built on UnityEngineUnityUnity Technologies' engine powers a wide range of PC titles, from indie projects to large multiplayer games. In the competitive-shooter space, Escape from Tarkov is the notable Unity-based title.8 games in this family →, it runs through the HoYoPlay launcher and the Epic Games Store on PC. It became one of the highest-grossing gacha games, passing 100 million dollars on mobile within ten days of launch.

Installing Honkai: Star Rail means a HoYoverse kernel-mode anti-cheat on your system. The single most useful precaution is the one the 2024 incident points to: install only from the official HoYoPlay launcher, the Epic Games Store, or the platform store, because the documented ransomware risk for this game came from tampered installs placing a malicious DLL beside the real, signed executable. HoYoverse's 2020 commitment, made about Genshin Impact, was that its anti-cheat would not keep running once the game is closed; no separate statement about this game's driver was found. The Genshin mhyprot2.sys plate in the drivers section is worth reading for why kernel anti-cheat drivers are their own security surface, even though Honkai: Star Rail loads a different one.

Honkai: Star Rail installs HoYoverse's kernel-mode anti-cheat on PC, whose driver today is HoYoKProtect.sys, the same component Genshin Impact and Zenless Zone Zero load. That has not always been true: from launch through version 2.5, HoYoverse's own package file lists carried components of Tencent's Anti-Cheat Expert in an AntiCheatExpert folder, and version 2.6, released October 23, 2024, replaced them with HoYoKProtect.sys. No release build in its package lists has carried the legacy mhyprot2.sys driver that became a textbook security case, and HoYoKProtect.sys is not on the public vulnerable-driver lists that catalogue that older driver. The main process is StarRail.exe, signed by Cognosphere, alongside a StarRailBase.dll component.

The trust history that matters here is the publisher's, and it has two parts told carefully. First, the cautionary one that is not this game's: in 2022, Genshin Impact's anti-cheat driver mhyprot2.sys was abused by ransomware operators as a bring-your-own-vulnerable-driver tool to switch off antivirus from the kernel. That driver is catalogued in this guide's drivers section, and it is the clearest lesson in why a signed kernel driver is not automatically a safe one. That case was Genshin's driver, not Honkai: Star Rail's. Second, one that is this game's: in September 2024, researchers documented a ransomware sample that abused Honkai: Star Rail through DLL sideloading, dropping a malicious StarRailBase.dll next to the legitimately signed StarRail.exe so that ransomware loaded when the game launched. The legitimate, signed game is not itself harmful; the risk came from tampered or unofficial installs. Sources include SC Media, BleepingComputer, and Trend Micro.