Understanding RenEngine: A Deep Dive into Its Malicious Operations and Distribution Tactics
| Shelf | AI & ML |
|---|---|
| Date in | |
| Readers | 455 |
RenEngine, a loader facilitating malware distribution, disguises itself as game files, affecting users globally through various deceptive channels.
Recent investigations into malware distribution reveal that attackers often disguise harmful software as game cheats and pirated applications. One notable example is the RenEngine loader, identified in a large-scale operation spreading infected games. Researchers from Howler Cell first announced the findings in February 2026, noting that this loader was delivered via a modified version of the Ren'Py game engine. Kaspersky detects RenEngine as Trojan.Python.Agent.nb and HEUR:Trojan.Python.Agent.gen, identifying it as both a significant and persistent threat.
While the loader was formally recognized in 2026, Kaspersky had already begun detecting early forms back in March 2025 when it was notably used to distribute the Lumma stealer (Trojan-PSW.Win32.Lumma.gen). The campaign's ongoing activity suggests a sophisticated distribution network utilizing various deceptive methods, primarily through pirated game downloads.
Incident Analysis
Disguised as Visual Novels
The initial incident took place in March 2025, where attackers exploited a popular gaming website to distribute their malware. Users encountered a download page featuring two similar options—free or direct download. However, both linked to a MEGA file-sharing service, directing users to download what they believed was a game. Instead, upon launching, users experienced a download process that stalled at 100%, indicating that the actual malicious code was already deployed in the background.
Game download page
Further analysis of the source files revealed Python scripts responsible for initiating device infection under the guise of loading the game. These scripts featured functions designed to bypass sandbox detection and decrypt the embedded malicious payload, which was then extracted to a temporary directory for execution.
Source Files Examination
The full infection chain
In the temporary directory, legitimate executables were mingled with malicious code. Notably, DKsyVGUJ.exe appears non-malicious, merely renaming a well-known genealogy application, while the borlndmm.dll library coupled with the attacker-modified cc32290mt.dll library provides crucial functionality to initiate the malware chain.
HijackLoader Deployment
The loader uses the dbghelp.dll system library as a runtime environment for the initial payload. Attackers overwrite this library in memory with a decrypted shellcode extracted from another file, launching a modular and flexible deployment mechanism, known as HijackLoader. This malware first surfaced in mid-2023 and brings a sophisticated method of injection and operation that poses significant challenges for threat detection.
The payload deployment proceeds through varied configurations, with the modular ti module managing the process preparation for the final payload injection. The specific approach involves creating child processes that aid in the obfuscation and control of malicious activities, pointing to a high degree of programming sophistication.
Injection Process
The payload, which can operate in numerous configurations, is carefully injected using Windows API calls that allow for memory manipulation. Layered execution prevents immediate detection, utilizing temporary files for malicious payload storage during this process. The eventual goal is to inject into a common process like explorer.exe, cementing its presence on the victim's device.
- The initial step involves writing the payload to temporary storage. Notably, the order of bytes being written is intentionally jumbled to further evade detection.
- Next, the infector triggers the
ZwCreateSectioncall to load the payload from this temporary location into the machine's memory before it is removed entirely from disk. - The process starts a new instance of
explorer.exe, allowing for the final payload to be seamlessly injected into a legitimate process.
Ultimately, the injected final payload operates as a stealer mechanism, targeting sensitive user data and predominantly linked to the Lumma family of malware.
Beyond Gaming
The RenEngine loader isn’t limited to distributing games but has expanded its reach to other software, including popular applications like CorelDRAW. Attackers create multiple fraudulent sites that offer modified or cracked versions of legitimate software, further facilitating the spread of this malicious infrastructure.
Distribution of RenEngine under the guise of the CorelDRAW pirated version
Users clicking on these deceptive links are often redirected across various sites before the malicious files arrive on their devices, further demonstrating how the RenEngine loader adapts to avoid detection.
Global Impact and Recommendations
The distribution of RenEngine has been widespread, with the highest incidence rates in Russia, Brazil, Türkiye, Spain, and Germany. This broad impact indicates that attacks are not specifically targeting individual users but rather aiming for mass infections across various demographics.
To evade these types of infections, it’s essential to download software only from reputable sources. Users should prioritize employing trustworthy security solutions that employ behavior-based detection, a feature offered by Kaspersky Premium. Such proactive measures can notably enhance defenses against the ongoing threat posed by various attacker groups utilizing the RenEngine loader.
Indicators of Compromise
For those concerned about potential impacts from RenEngine, here are key indicators of compromise:
This evolving malware landscape highlights the importance of continuous vigilance and protective measures against such cunning distribution strategies.
