Face Off - Auditing FACEIT's Anti-Cheat for CS2
- 5 hours ago
- 7 min read
About this blog
When a game publisher or platform starts working with Intorqa, you might assume they have a major cheating problem. More often than not, however, they are already significantly investing in anti-cheat, and ask for our help and services to reduce any remaining gaps. Since we launched in 2020, Intorqa has helped several of the world’s biggest publishers do exactly that.
This was the case with FACEIT, who in 2025 contracted us to independently assess their CS2 anti-cheat and help monitor the cheating community at scale, complementing the work their own integrity team was doing - as demonstrated by sentiment from the cheat communities:
Whenever we engage with anti-cheat teams, we report what we observe, whether it’s good news or otherwise. It’s only in this way that game security can be optimised. This briefing outlines what we’ve observed since the end of 2025.
Why CS2 on FACEIT is worth auditing
FACEIT is one of the most popular CS2 environments outside of official Valve matchmaking. Pro-careers have been launched from it - for example, ZywOo and m0NESY are two world-class professionals today who climbed through the platform’s ranking before joining known organisations - and top teams use FACEIT Elo and amateur competitions on the platform as a scouting signal. The platform awards millions of dollars in prize money each year through its own leagues and 3rd-party hosted tournaments, with qualifier paths into higher-tier competition attached.
These high stakes make it a high-value target for cheat developers and customers, and the legitimacy of their leaderboard a frequent point of discussion amongst the player community.
Mapping the landscape
Our first step was to map the threat landscape by monitoring cheating community discussion. We researched public and private vendors claiming to sell cheating products for CS2 on FACEIT, e.g. pricing, features, claimed undetected status, and customer sentiment.
After the initial three months, we were tracking 50 unique vendors. By March 2026, that number had grown to 88.
This is a technically demanding cheat scene relative to most we study. Software-only options have largely disappeared from the market, and viable approaches now often cost more than many players spend on their PC. That observation alone tells you something about where the bar has been set.
What was being sold fell into a handful of categories:
Category | Technical Description |
|---|---|
Firmware / DMA | PCIe DMA card reads game memory directly over PCIe, streaming data (e.g. opponent positions) to a second PC - no code runs on the game machine. |
AI | A capture card + CV model reads video output; detections drive an external USB HID device (Arduino/Makcu-style) for human-like mouse input. |
VMD | Abuses Intel VMD to remap NVMe/PCIe topology, hiding a DMA card's PCIe presence from the OS. |
Spoofer | Forges disk serials, SMBIOS/motherboard UUID, MAC address, TPM key - defeats hardware-ban persistence. |
SMM | Exploits SMIs to run code at Ring −2, below the OS and hypervisor. |
Lagswitch | Throttles or drops outbound packets to exploit a client side bug where it moves the player's view. |
Other | Userland aimbots/wallhacks, common in non-FACEIT CS2 matches, running inside the game's own process. |
The second step was to test whether the cheats on sale actually worked. Vendors’ marketing routinely claims their products are ‘undetected’. Customer vouches, scam reports, and our own hands-on research tell a different story in many cases.
DMA or go home
When we began, DMA cheats were widely considered the most viable undetected option for FACEIT.
However, since November, FACEIT has been increasing the scaling requirement of Input-Output Memory Management Unit (IOMMU) to make it a required standard for all players. Alongside Virtualization-Based Security (VBS), IOMMU acts as a hardware-level firewall for RAM, restricting what plug-in devices can access, and preventing DMA cheats from reading protected game memory.
Standard DMA cheats were effectively neutralised. Sentiment in the cheat communities shifted within days:
Naturally, cheat vendors responded to this change. The first attempt was VMD (Volume Management Device) firmware, marketed as a way to mask cheat activity using storage management protocols.
Our monitoring picked up interest rising in VMD only two weeks after FACEIT’s IOMMU announcement and enforcement waves were rolling out, peaking around the week of December 15th. It then tailed off as cheat user reports shifted from "works" to "unstable" and "risky", consistent with FACEIT ban waves beginning to detect it reliably.
Our assessment: IOMMU has substantially closed the standard DMA route. VMD was the first cheat vendor response and has not held up. IOMMU Coverage remains the variable to watch; at ~97% it's strong but not absolute.
DMA fights back
Anti-cheat work is often compared to a game of whac-a-mole, and that was certainly the case here, as existing vendors didn't give up, and new ones claimed new solutions.
From January to March 2026, there was a surge in interest in SSD/NVMe emulation, marketed by cheating companies as a post-IOMMU evasion technique. This method involves DMA hardware emulating a storage card, e.g. presenting itself in Device Manager as a legitimate hard drive and responding to storage driver queries correctly, while simultaneously reading game memory in the background.
In practice, the technique was already blocked by IOMMU. The surge looked more like vendors capitalising on confusion in the market than a working bypass. Over this period, 25+ vendors launched FACEIT-targeted SSD-emulation products, despite the underlying approach being non-viable from the start. On March 15th 2026, a FACEIT ban wave, unrelated to this category, ran in parallel and further cooled interest.
Around the same time, another vendor claimed a different approach. They were marketing a custom motherboard sold as a way to bypass IOMMU entirely, used alongside a man-in-the-middle setup. A genuine NVMe SSD, network card, or other PCIe device was physically connected to the cheat hardware, which sits between that device and the PCIe bus. Queries pass through to the real hardware and get authentic responses. The cheat uses the legitimate device's PCIe presence as cover to conduct its own DMA reads. In Device Manager, it shows up as a normal working device.
The MITM technique itself isn't new; it's been around for years and is blocked by IOMMU the same as standard DMA cheats. The custom motherboard was the actual pitch but is now classified by the cheat community itself as High/Critical Risk of detection.
Our assessment: No consistent DMA bypass for FACEIT has emerged from this period, despite sustained vendor effort and high-profile launches. Cheat provider marketing in this category continues to take advantage of social media outrage, virality, and customers' susceptibility.
2PC AI Cheats
During 2025, AI Aimbots (also called AI Pixelbots) had established themselves as an option in several games once standard software exploits started being detected. We covered this previously in an earlier briefing: [https://www.intorqa.gg/post/the-new-ai-mbots].
What changed was that they started being used alongside a setup with two separate PCs, a configuration more commonly associated with DMA cheating, to reduce the detection surface.
Of the 36 new vendors entering the FACEIT scene in Q1 2026, 17% were selling AI / multi-device products. Firmware / DMA still made up the majority at 52%.
AI cheats used with multiple PCs is worth flagging because the detection problem is genuinely different.
2PC DMA cheats read the game's memory directly. The PCIe DMA card sits inside the gaming PC and lets the second PC pull raw data, for example, exact enemy coordinates, straight from RAM. The second PC then calculates the aim angle mathematically and sends the correction to a HID emulator. It can know everything about the game world, including things not rendered on screen, e.g. opponents’ positions.
2PC AI Aimbots read the screen visually. They never touch game memory. They capture the HDMI output and run a computer vision model to detect enemies from the pixels on screen, much as a human would. They can only act on what's visible on screen, but they require no hardware installed inside the gaming PC.
DMA is more powerful and versatile. 2PC AI is less invasive and leaves a smaller footprint, which makes it harder to detect through the kind of hardware-level checks that have been effective against DMA.
Price is also a factor. 2PC AI monthly subscriptions sit between $20 and $70 and although they are now rising, they are comparable to a traditional software cheat, and significantly below the $250–$1,500 paid for firmware alternatives.
To combat this security teams are always looking to harden their defences. In the case of FACEIT, one of the steps taken has been adding behavioral machine learning to their anticheat stack. This is because AI cheats leave subtle but consistent signatures, and with statistical modelling of aim patterns, reaction times, and movement trajectories, detections are possible, even with AI cheats designed to mimic humans.
Our assessment: 2PC AI cheats are the most credible emerging threat we identified during the audit. Detecting these is a harder problem than for DMA, and the low price point widens the customer base. However, with the increased use of behavioural detection, itself optimised with AI, the security teams are taking the necessary steps to keep up.
Overall Conclusion
Across the audit period, we observed a consistent pattern: a new bypass technique emerges, gains traction for a few weeks, and is then either detected or hit by a ban wave. The shelf life of viable cheats for FACEIT has been measurably short.
Across every community we researched, FACEIT is currently ranked as one of the hardest anti-cheat clients to bypass.
DMA hardware was often treated as the minimum viable approach for FACEIT; software-only methods are dismissed by the communities themselves. However, no credible DMA bypass is currently confirmed, despite firmware vendors charging up to $1,500 a month for products that promise it. Our own testing supports that assessment.
The cheating arms race will continue, and AI Cheats are the most plausible front for the next phase. But for the period audited, the picture is clear enough: cheating on FACEIT is expensive, unreliable, and increasingly hard to get away with. Of course, the game of whac-a-mole never stops. It will never be game, set and match, but in this case, it’s certainly advantage FACEIT.