How Does Activision Ricochet Work?

Ricochet launched in late 2021 as Activision''s answer to escalating cheat-driven attrition in Warzone. It has gone through five years of expansion and now spans every modern Call of Duty title. The architecture is both kernel-mode client-side AND a deeply integrated server-side decoupling layer that responds to suspected cheaters in real time.

Kernel driver basics

Ricochet ships a signed kernel driver loaded at COD launch. It registers process creation, thread creation, and image-load callbacks via the standard PsSetCreateProcessNotifyRoutineEx / PsSetLoadImageNotifyRoutine / PsSetCreateThreadNotifyRoutine interfaces, strips handle access rights to the COD process, scans memory for cheat signatures, walks loaded module lists for traces of recently-loaded drivers, and exports telemetry. So far this is conventional kernel AC.

What makes Ricochet distinctive — server-side mitigations

Ricochet pioneered server-side cheat mitigation rather than pure ban response. When the AC suspects a player of cheating but hasn''t yet earned a confirmation-grade signal, the server can: (1) "Cloak" — make the suspected cheater invisible to the suspected wallhack''s perspective; (2) "Damage Shield" — render the suspected cheater immune to bullets from the suspected aimbot user; (3) "Hallucinations" — inject fake player models into the cheater''s view. The point is to let the suspected cheater "burn" — to keep playing detectably-broken sessions long enough to collect evidence — rather than tip them off with an instant ban.

Black Ops 7 and Remote Attestation

Call of Duty Black Ops 7 (Nov 2025) added Microsoft Remote Attestation as part of Ricochet''s startup flow. The implementation rejects sessions where the TPM-signed attestation quote indicates an untrusted boot state — test-signing enabled, unsigned drivers loaded, Secure Boot disabled. This is the first AAA shooter to publicly gate matchmaking on platform attestation. The implication: BO7 raised the floor of "what hardware-software state is required to play" higher than any prior COD release. See What is Microsoft Remote Attestation.

Ban wave cadence

Ricochet runs aggressive ban waves — typical announcement patterns are quarterly with single-wave totals in the tens of thousands to low hundreds of thousands. Activision publishes Ricochet progress reports periodically with ban totals. The pattern: bans land in waves rather than instantly, accumulated evidence is processed in batches, and many bans pull from telemetry weeks old.

What Ricochet reads — and what it doesn''t

Like every kernel AC, Ricochet sees: process memory in the COD process, loaded drivers on the system, kernel callbacks for new processes, SMBIOS and hardware fingerprint, TPM identifiers and (for BO7+) attestation quotes. It does not see: contents of a separate machine, properly hidden DMA reads with bypassed IOMMU + AER-clean firmware, or perfectly externalized cheating that never touches the COD process address space. The arms race converges where it always does — hardware roots of trust and behavioral ML.

Practical impact and RawCheats

COD is one of the cheat-industry''s biggest markets and one of the most ban-heavy. Operating safely requires aggressive HWID hygiene (always run a spoofer before cheating sessions — see Raw Spoofer), behavioral tuning (no obvious aimbot, no clear no-recoil, tournament-tier settings — see our COD Warzone Guide), and account isolation (cheating account ≠ main, ever). The Ricochet architecture punishes carelessness brutally and disproportionately at wave-ban time.

Forward look

BO7''s attestation move suggests Ricochet is the AAA AC most aggressively committing to the hardware-attestation roadmap. Expect TPM-bound HWID enforcement, possible Pluton-gated matchmaking, and continued investment in server-side ML cloaking. The "buy the cheap public cheat and play Warzone" era is over; what remains is a smaller, more careful, more expensive cheating market.

How Ricochet compares to EAC, BattlEye, and Vanguard

Ricochet sits in the upper-middle of the kernel-AC stack. It''s less invasive at the platform-attestation level than Vanguard (which requires TPM 2.0 + ELAM-loaded driver + Secure Boot at full enforcement), and roughly on par with BattlEye and EAC for client-side kernel surveillance. Where Ricochet distinguishes itself is the server-side mitigation layer — the Cloak/Damage Shield/Hallucinations system has no direct analog in other consumer ACs. Most ACs flag-and-ban or flag-and-review; Ricochet flag-and-degrades-the-cheater''s-experience, then bans. This produces longer evidence-collection windows and harder-to-anticipate ban timing.

What Ricochet has been adding through 2024-2026

The trajectory: deeper Unreal Engine integration (COD shares engine lineage with Unreal-derived branches), expanded behavioral ML on demo replays, the Black Ops 7 Microsoft Remote Attestation flow, and tighter HWID-correlation through Activision''s account infrastructure. Black Ops 7''s Nov 2025 launch was the most significant Ricochet upgrade in years — the attestation gate moved COD''s AC floor up materially. For cheaters, the practical impact is that COD has shifted from "moderate" to "harder" on the difficulty scale within 18 months. The "buy a public cheat for $15/month and grind Warzone" era is structurally over for serious cheaters. See COD Warzone Cheats Guide.