The Vigilante Hunting Down Cheaters in Video Games

In May, some players in the popular competitive shooter Valorant seemed to have super powers. Every time they fired their guns, they hit their opponents right in the head, killing them quickly. They practically couldn't miss.

In some way, these players did have superpowers: they were using one of the most advanced cheats for Valorant, the five-on-five tactical first-person shooter made by Riot Games. The cheat was essentially a program that hacked the video game and subverted its rules by exploiting flaws in the game’s code. While Riot continues to fight cheaters across its games, that particular cheat is no longer available thanks to a vigilante who works around the clock to catch cheaters and their tools, reporting them to companies like Riot or Blizzard, the makers of Overwatch, another popular online shooter. He's not employed by any game developer, nor does he get paid for his work, but he does devote a great deal of his time and energy to stopping cheaters, and when he finds something, game developers listen.

His name is Mohamed Al-Sharifi but he’s best known as GamerDoc. This 24-year-old from London is becoming an important player in the seemingly never-ending and ever-escalating cat-and-mouse game between gaming companies against hackers and cheat developers. All online games today employ advanced anti-cheat systems that monitor gamers’ computers to see if they’re running any cheats. For Valorant, Riot Games developed the Vanguard system, which runs at the kernel level. This is an integral part of the operating system that manages almost every single thing a system does. It should be one of the most highly secure parts of any computer system, and which could completely compromise a user if accessed by a hacker. Riot has drawn criticism for Vanguard for this reason, with security experts saying it's too intrusive. But even a game with an advanced system like Vanguard has cheaters. The company banned more than 8,000 of them when the game was still in beta.

“No game is unhackable. No cheat is undetectable,” GamerDoc said in a phone interview. “It's just a matter of how and where.”

How and where depends on circumstances, but GamerDoc is often involved.

“We're always happy to receive information from people, especially if they have insight into cheating communities,” Paul Chamberlain, the anti-cheat lead for Riot’s Valorant, said in an emailed statement. “The information people like GamerDoc provides helps us accelerate our anti-cheat development and ultimately gets cheaters out of the game faster.”

Three sources at a gaming company who are involved in anti-cheat efforts, and who asked to remain anonymous because they were not authorized to speak to the press, said that GamerDoc has been very effective at hunting cheats and cheaters, leading to the cheats getting patched and the cheaters banned.

“His tips have helped us react faster to some cheats, which can easily send [the cheat developers] out of business,” said one of the employees.

Another one said GamerDoc has been “super helpful in finding cheats and reporting them to us.”

Blizzard did not respond to a request for comment.

“For the anti-cheat developers he's their volunteer scouter,” said a cheat developer who goes by the moniker sadko2. “He's built a community and added an extra layer of reporting. Players manually reporting somebody with proof of concept is kinda spoon-feeding the anti-cheat developers and real reverse engineers. So to conclude, he can do nothing by himself, all alone, but his strong community and manual reporting feature is definitely a big threat to cheat developers.”

GamerDoc admitted that he’s “made many enemies doing this.” 
At one point, GamerDoc said a group of them launched a now-deleted GoFundMe to raise money to hire an assassin to take him out. (Motherboard was not able to verify that the GoFundMe ever existed, and the donations in the screenshot appear to have been copy pasted from another fundraiser.) Another time, someone tried to get his old boss to reveal his home address. He said he also regularly receives death threats. And while he admitted that this kind of stuff affects him mentally, it won’t stop him from doing what he’s passionate about.

GamerDoc started hunting cheat developers and users in 2018, when he created a Discord server called The O.W. Police Department to expose players in Overwatch who were "win trading." In this scheme, groups of players allow each other to win matches in order to artificially increase their ranking. The attention he got for this led to more players reporting cheaters.

“I started to look into these things, I started to ask for proof, I started to ask for video clips, and it just kept piling up,” GamerDoc said. “[I thought] this is like a huge disaster, there's too many people cheating in this game.”

His success there motivated him to do this regularly and go after not just individual cheaters, but the whole ecosystem. Cheating in games is a huge business that moves millions of dollars, as an investigation in PC Gamer revealed in 2014. Players who use cheats often get them from resellers who promote them on customer-facing websites. These sellers have direct relationships with cheat developers who reverse engineer game engines and develop what essentially are exploits which are worth thousands of dollars. This is the goliath GamerDoc is going up against.

“I’ve just been trying to find ways to break cheats and destroy cheating businesses and get justice for players,” GamerDoc said.

His motivations are simple: he thinks games are being “ruined” by cheaters, by “copy paste hackers who just try to earn a few quick bucks.”

“I just hate cheaters in general. I think it's selfish to have all the fun for yourself. People have a job they come home to enjoy a nice day of gaming, and for that to be ruined because of some kid who used his moms credit card to buy cheats just sucks,” GamerDoc said. “Not only that, there are people who even try to compete at a pro level with cheats ruining the competitive integrity for many who practice countless hours to be the best.”

GamerDoc now runs two Discord servers, The O.W. Police Department and The Valorant Police Department, which have almost 3,000 and over 2,000 members respectively. In these channels, volunteer vigilantes post reports of alleged cheaters, sharing their in-game IDs, the date and time they were seen cheating, the region where they play in, and any evidence to support the claim, such as videos of the cheater. GamerDoc and other admins on the servers comb through the reports, review them, and send the ones that they deem accurate to Riot Games and Blizzard.

Especially since he was laid off at his day job due to the economic crisis triggered by COVID-19, GamerDoc said hunting cheaters has practically become a full time job for him. GameDoc declined to say whether he makes any money via bug bounty programs.

“I have somewhat of a reputation to maintain that I'm not sending false reports over, because it would suck for the player, and it would suck for everyone else, and I would lose credibility from the company.” GamerDoc said. “I don't want to waste their time.”

GamerDoc’s super power seems to be, put bluntly, that he gives a shit about stopping cheaters.

In order to find cheats and cheaters, GamerDoc also lurks on cheaters' forums and Discord channels, “gathering intelligence,” as he put it. Sometimes, that means socially engineering the cheat developers or sellers into providing him the cheat so he can pass the cheating app on to the anti-cheat teams at Riot Games, Blizzard, and other game studios. Other times, GamerDoc said that cheat developers get in touch with him to expose other cheats made by competitors in what is a big business where the best cheats can go for hundreds or even thousands of dollars.

“Cheating is pretty much like drugs. And there's like a whole hierarchy as well with these cheating businesses where you have the developer, you have the assistant developer, you have the sales manager, then you have the under sales manager, and then you have the resellers,” GamerDoc said. “Everyone does their part and makes money.”

GamerDoc doesn’t just disrupt cheaters by ratting them out to video game companies, he also names and shames them publicly on his Anti-Cheat Police Department Twitter account. Sometimes, GamerDoc publishes their names or gamer IDs so that other gamers can report them or stay away from them.

Since he started in 2018, he estimates that he has gotten between 50,000 and 70,000 cheaters banned across Overwatch and Valorant, counting both reports sent to his Discord channels, as well as ban waves triggered by him reporting popular cheats to the companies. Two sources who work at a gaming company said those numbers are feasible. But it’s also important to remember that after GamerDoc alerts the companies, the developers do their part of the job and look into the reports and determine whether they are accurate, which is crucial work.

“It's not always easy as a single person to fight versus what looks like a goliath but GamerDoc has people on his side, believing in his cause, and maybe one day big corporations will see that as well and put a better anti-cheat in their software,” said one of GamerDoc’s collaborators, who goes by the name of Hina.

For the future, GamerDoc said he is planning to launch a public website where gamers can send in reports for moderators to review them, send them to the gaming companies, and then publish a list of known cheaters.

As gamers who play popular online games like Call of Duty: Warzone complain about pervasive cheating, game studios are ramping up their efforts, designing better, more sophisticated anti-cheat systems. But they also employ some of the same techniques GamerDoc uses, monitoring and cultivating informants within the cheating community, according to two sources who work at a gaming company.

In the case of the Valorant cheat, GamerDoc obtained the cheat and passed it on to Riot, which patched it and rendered the cheat useless. That particular cheat was made by a developer who calls himself Bukky. Bukky said he used to sell a subscription to the cheat—providing continuous support—for 15 euros a day, 70 euros a week, 150 euros a month, or 500 for life (around $17, $82, $177, and $590 respectively). Bukky said he had almost 10,000 users who purchased the subscription through his website Applecheats.cc.

Just like his cheat, Bukky’s website is now down. But Bukky denied ever getting caught by GamerDoc, and dismissed his work.

“He’s just an asshole that sends cheats loaders to Riot,” Bukky said in an online chat. “He’s nothing special.”

Sources involved in anti-cheat efforts, however, confirmed GamerDoc’s account of the story, suggesting Bukky is just trying to diminish GamerDoc’s accomplishments.

“Acquiring a key for the cheat, or a copy of the cheat or a memory dump of the game while the cheat is running are all things that GamerDoc has provided that have helped us detect a new cheat faster,” said an employee of a gaming company.

“I'm always happy when I'm banning a cheater or getting their stuff detected,” GamerDoc said.

Subscribe to our cybersecurity podcast, CYBER.