Viking and BattlEye in War Thunder have been checking the client on two different levels at once since December 2024, and for a cheat that means one thing: you need to be clean in front of both systems simultaneously, not just one. BattlEye gained OS kernel-level privileges and can hand out a permanent hardware ban with no right to appeal. Viking, by contrast, runs at ring-3 level right inside the game client: it does not require administrator rights, encrypts the data it transmits, and reacts to suspicious behavior inside the game process itself, not the whole system.
We only keep software in our catalog that has been tested against both systems at once. Current options with prices and status are listed on the War Thunder cheats page. We ran our tests in Arcade Battles, Realistic Battles, and Simulator Battles: there is no aim assist and no third-person view there, so the risk of getting caught on your actual actions is higher than just getting flagged by a signature. Below we break down both layers of protection separately and show which builds our team has tested for which scenario.
How Viking differs from BattlEye in practice
The difference between the two systems is not a footnote in a patch note, it is a concrete question: what exactly do they see, and how fast do they react. This applies across all three combat domains (aviation, ground vehicles, and the fleet): BattlEye connects at the OS kernel level and watches the entire system as a whole, drivers, process memory, injection attempts from outside the game. Viking lives inside the War Thunder client itself at ring-3 level and reacts the same way whether you are in Arcade Battles or Simulator Battles, so it only sees what happens inside the game process, but it reacts almost instantly because it never has to reach the system kernel.
What changed after Easy Anti-Cheat was dropped
Before December 2024, War Thunder ran on Easy Anti-Cheat, and Gaijin still reviewed some disputed bans manually through appeals. With the move to BattlEye and Viking, the decision on a hardware ban became final: once a BattlEye signature triggers at the kernel level, the appeal is no longer reviewed. For a cheat, that means the cost of a mistake went up. Previously you could get a temporary ban and come back after a review, now a kernel-level detection from BattlEye closes off your hardware immediately with no way to contest the decision. That is exactly why our specialists keep a separate signature registry for each system instead of testing software only against the old EAC standards.
BattlEye: kernel access and bans with no right to appeal
BattlEye replaced Easy Anti-Cheat in December 2024 and gained system-level privileges on both the client and the server. That means access to all process memory, drivers, and any attempt to hide modifications at the OS level. Hardware bans from BattlEye are permanent and carry no right to appeal, so software that hooks into the system at the kernel level is at far greater risk than a cheat that stays within the boundaries of the game process.
Viking: protection inside the client, no admin rights needed
Viking does not reach up to the kernel, it does not need to. It is built right into the War Thunder executable, it is obfuscated, it encrypts everything it sends to the server, and it does not request administrator rights on launch. Because of this, Viking is faster at catching anything that interacts directly with the game: spoofed aiming data, reading client memory, tampering with rendering. Software that avoids system hooks and works through methods safe for ring-3 passes this check reliably, and those are exactly the builds we keep listed as undetected.
In practice, this shapes how the software itself is built. The working builds in our catalog use a different loader on every launch, encrypt their signatures in memory, and get updated within 24 hours of a War Thunder patch if Gaijin changes how Viking checks things. We do not publish a card as undetected until the developer confirms testing on the current patch: some cheats in the catalog temporarily switch to Updating status on the exact day an update drops, and we keep that information visible instead of staying quiet about temporary issues.
Simulator Battles: why the risk is higher than in Arcade
In Arcade Battles, the game itself provides aim assist and a third-person view, so some of the behavior patterns that normally give a cheat away are masked by the built-in assists by default. In Realistic Battles there is noticeably less assistance. In Simulator Battles there is none at all: no aim assist, no third-person view, just the cockpit and the instruments. That means every sharp, overly precise, or overly fast input stands out against a regular player far more, and Viking analyzes exactly this kind of behavior inside the game process in real time. We tested the aimbot and ESP combination separately in each mode and here is what we saw: the fewer built-in assists a mode has, the more obvious crude aim automation becomes if it is not adapted for a ring-3 check. That is why for Simulator Battles we recommend builds with adjustable aim smoothness rather than a hard snap onto the target.
| Parameter | BattlEye | Viking |
|---|---|---|
| Access level | Kernel-level (OS kernel) | Ring-3 (game process level) |
| Administrator rights | Required | Not required |
| What it checks | The entire system: drivers, other processes' memory | Only the War Thunder client |
| Reaction speed | Slower, analysis at the OS level | Faster, reacts inside the game process |
| Consequences of detection | Permanent hardware ban with no appeal | Account ban, signature sent to the server |
How Gaijin decides whether to ban an account
Automation is not the only source of bans. A report from another player or a server replay submitted through warthunder.com goes to manual review by Gaijin moderators, who cross-check it against BattlEye and Viking signatures. In December 2024 this combination resulted in 7106 accounts banned in a single month, and some of those were caught specifically through replay review, not automatic detection. We covered the mechanics of reports and ban statistics separately: how replays and reports work in War Thunder. That is a second way to get caught that has nothing to do with the anti-cheat itself.
What to choose for War Thunder for double protection
Since both systems check different levels, it makes more sense to choose software based on what it actually touches in the game, rather than just on price. We cross-checked this against real catalog listings and their current status, here is what to look at for different scenarios.
- Full-control tank battles: MASON INTERNAL (excellent, from 500 rubles a day): an aimbot with automatic lead and ESP by vehicle module (ammo rack, engine, transmission). This set of features interacts directly with the game process, which is why we test it specifically against Viking signatures, not just at the driver level. Full breakdown in the MASON INTERNAL review.
- Aviation and bombing: MEMEZ (excellent, from 300 rubles): bomb prediction, penetration crosshair, and a built-in radar for calculating your approach to the target. Useful in Simulator Battles, where there is no CCIP by default and a miscalculation shows immediately.
- Scouting only, no aim interference: WARCHILL (excellent, from $5): smart 3D ESP with visibility checking and a unique loader on every launch that clears traces after the session. The aimbot in this build is not working right now, take it for ESP only: a behavior profile with no interference in aiming is objectively lower risk under Viking.
- First test before a pricier purchase: check the card's status right on the hub before paying. If it is not undetected under the current patch, wait for the update instead of buying blind: status changes within 24 hours of a War Thunder patch going live.
The full list of current options with pricing, undetected status, and a comparison across modes is on the War Thunder cheats → page. We update card status after every War Thunder patch and change a build's position if its signature shows up in the BattlEye and Viking combination. The same page shows which cheat covers which combat domain (aviation, ground vehicles, or the fleet) and which mode it was last tested in.
If you are not sure which build fits your combat domain (aviation, tanks, or the fleet), ask our community: Telegram (200+ members) and Discord (637+ members) respond fast and keep you up to date on current statuses.
Frequently asked questions about War Thunder cheats
If a cheat does not touch BattlEye, is it safe?
No. Viking checks the game process independently of BattlEye, so even software with no system hooks still has to stay clean in front of that check too. Ring-3 protection reacts to actions inside the client directly, without touching the kernel, so kernel level has nothing to do with it here. ForgeCheats tests builds against both systems at once, not just one.
Why do cheats now get banned permanently with no right to appeal?
That is exactly how BattlEye works: it has kernel-level privileges, and Gaijin does not review a hardware ban triggered by its signature. Previously, with Easy Anti-Cheat, some bans were still reviewed manually, now that does not apply to kernel-level detection. The practical takeaway for a player is simple: if a build hooks the system at the kernel level, the risk of losing hardware access for good is far higher than working only within the boundaries of the game process.
Does Viking require administrator rights on launch?
No, and that is a key difference from BattlEye. Viking runs at ring-3 level inside the War Thunder client itself, so it launches without requesting elevated rights, but that does not make it weaker: its reaction to suspicious behavior is actually faster.
Can you get banned without a cheat being detected, just from a report?
Yes. A report or a server replay goes to manual review by Gaijin moderators, and some of the 7106 bans in December 2024 came from exactly that, not automatic detection by BattlEye or Viking. Your in-game behavior is worth keeping within normal bounds too, separately from your software's status: overly perfect accuracy in a replay stands out even without any signatures.
Where can I check the current status of War Thunder cheats for the current patch?
On the War Thunder cheats page, every card's status is updated manually after testing against the patch, not automatically. It also lists prices and exactly what the ESP or aimbot catches on each build, plus which combat domain and mode the BattlEye and Viking combination was last tested against.
