The latest SafePay ransomware warning highlights an often-overlooked part of security assessments: understanding what is happening on a Windows host. Here's the open-source C++ project I'm building to make that process easier.
On October 20, 2026, the FBI, CISA, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and UK law enforcement partners published a joint cybersecurity advisory about SafePay ransomware.
The advisory reports that SafePay has affected at least 600 victims across multiple critical infrastructure sectors. Its operators have used compromised credentials, password attacks, phishing, and vulnerabilities in exposed systems to gain access. Once inside, they have also used legitimate administrative tools, created or taken over accounts, moved through networks, and disabled security protections.
The important lesson isn't just how attackers get in. It's what happens on the systems they reach.
Read the official FBI advisory.
That is the context behind a project I've been developing: Blue Bear, an open-source Windows host reconnaissance tool written in C++.
🔗 GitHub: https://github.com/KernelPhantom-010/blue-bear-Red-Teaming-Host-Recon-Tool
🐻 What is Blue Bear?
Blue Bear is designed to make initial host reconnaissance more convenient during authorized red-team engagements, penetration tests, and security research.
Instead of switching between several Windows utilities just to collect basic system information, Blue Bear brings multiple categories of host information into a single graphical dashboard.
The project uses C++ and Qt and is being developed for Windows 10 and Windows 11.
The idea is simple:
Get a clearer picture of the host before deciding what deserves a closer look.
🔍 What can it enumerate?
1. Host information
Start with the basics.
Blue Bear displays information such as:
- Computer name and Windows version
- Exact Windows build and system architecture
- Domain or workgroup membership
- Domain user information when the environment supports it
- System uptime
This helps establish the environment you're examining before moving into more detailed enumeration.
2. Process and DLL discovery
A list of running processes is useful, but context makes it more useful.
Blue Bear provides process names and PIDs, expandable views of loaded DLLs, and automatic flags for protected processes.
Full enumeration may require administrator privileges.
These details can help during authorized investigations into running software and process context. They do not, by themselves, establish that a process is malicious.
3. Token and privilege information
Windows security tokens contain important information about the security context in which a process runs.
Blue Bear exposes details such as:
- Token owner
- Integrity level
- Token elevation state
SeImpersonatePrivilegeSeDebugPrivilege
This makes it easier to inspect privilege-related information during an assessment.
A visible privilege is not automatically an exploitable vulnerability. Its significance depends on the surrounding configuration, access controls, and available attack paths.
4. Network discovery
Understanding a machine also means understanding its network context.
Blue Bear includes views for:
- Active and listening TCP connections
- Local and remote addresses, ports, and connection states
- Processes associated with network connections
- Network adapters and IP addresses
- Routing information
- The local DNS client cache
Having these details in one place can help a tester understand which connections and network settings warrant further investigation.
5. Windows services
Services and drivers are another important part of the host's configuration.
Blue Bear displays information including service names, current states, startup types, binary paths, service accounts, and descriptions.
During a security assessment, this can help you identify configurations that deserve manual review.
6. Persistence-related locations
Persistence is another reason to look beyond a simple process list.
Blue Bear currently includes enumeration of several common locations:
- Registry Run keys: autorun entries for the current user and all users
- Scheduled Tasks: task enumeration, including hidden tasks
- Startup Folder: files in the current user's Startup folder
- WMI Event Subscriptions: registered event filters and their associated WQL queries
These features provide a convenient overview of several places where software can be configured to run automatically.
They do not cover every possible persistence technique, and an entry should not be considered malicious without further investigation.
📰 Why does this matter in light of the SafePay advisory?
The SafePay advisory describes activity that goes beyond exploiting an exposed service.
After gaining access, the group has used legitimate Windows tools and administrative mechanisms to operate inside victim environments. The advisory also documents privilege escalation, persistence, lateral movement, and attempts to impair security protections.
That makes host context important during authorized security assessments.
Consider a few practical questions:
- Which processes are running, and which DLLs are they loading?
- Under which account and privilege context does a process operate?
- Which network connections are active?
- Which services are installed, and how are they configured?
- Which common persistence locations contain entries that need closer inspection?
Blue Bear brings information relevant to these questions together in one GUI.
The intention is to make it easier for a tester to explore the local system and decide where deeper investigation is justified.
Important distinction: Blue Bear is not a SafePay detector, an antivirus product, an EDR platform, or a ransomware removal tool. It does not patch vulnerable software, automatically match all known indicators of compromise, or prevent an attacker from gaining access.
It focuses on host enumeration. Its potential value is in improving visibility and reducing the friction of collecting basic information during an authorized assessment.
💡 What makes Blue Bear worth exploring?
There are already mature tools for system enumeration, penetration testing, and endpoint monitoring. Blue Bear is not intended to replace them.
What I'm working toward is a more focused, approachable way to explore several categories of Windows host information through a single graphical interface.
A GUI-first workflow
Blue Bear organizes host, process, token, network, service, and persistence information into dedicated views. That makes it easier to navigate between categories without relying entirely on separate command-line outputs.
A focus on Windows internals
The project is an opportunity to explore Windows APIs, security tokens, networking information, services, and persistence mechanisms through practical C++ development.
It's also an exercise in turning low-level system information into something easier to review.
Open source and evolving
Blue Bear is published under the MIT license. Its source is available for anyone interested in reviewing the implementation, reporting issues, or suggesting improvements.
The project is still evolving, and I don't want to present it as a finished enterprise security platform. The goal is to keep improving the functionality, reliability, and usability over time.
🚧 What's next?
I want to continue refining Blue Bear and making its enumeration capabilities more useful in realistic lab and assessment scenarios.
Areas for ongoing improvement include broader coverage, better error handling, and usability refinements.
Feedback from developers familiar with C++, Qt, Windows internals, and offensive or defensive security would be especially valuable.
If you spot a bug, have a feature request, or think something could be implemented more cleanly, please open an issue on GitHub.
🔗 Try Blue Bear
Repository:
https://github.com/KernelPhantom-010/blue-bear-Red-Teaming-Host-Recon-Tool
The project is intended for authorized penetration tests, systems you own, lab environments, and security research with appropriate permission.
I'm interested in hearing what the community thinks: Which Windows host-enumeration features do you find most useful during an assessment, and what would you improve in a tool like this?
If you're interested in C++, Windows internals, red teaming, or open-source security tools, check it out and share your feedback.
Let's make host reconnaissance a little less fragmented. 🐻
Sources and further reading
- FBI, CISA, and international partners — #StopRansomware: SafePay Ransomware (October 20, 2026)
- Reuters — SafePay ransomware group has targeted hundreds this year, US agencies say (October 20, updated October 21, 2026)
- Blue Bear source code and documentation
Top comments (0)