Preventing Crime-as-a-Service with Cutting-Edge Tools and Intelligence

Call ID

HORIZON-CL3-2023-FCT-01

Duration

01.09.2024 – 31.08.2027

Total Budget
0 M€
Partners
0
Countries
0
Use Cases
0

The Vision

Crime-as-a-Service (Caas)

CaaS represents a worrying evolution in the cyber threat landscape, transforming criminal activities into organised and commercialised enterprises. Similar to legitimate Software-as-a-Service (SaaS) platforms, CaaS offers on-demand illicit services such as malware rentals and fraud platforms. This shift lowers barriers to entry for cybercriminals, enabling individuals without technical skills to engage in activities like identity theft and payment card fraud through digital means. The consequence is a significant amplification of criminal operations’ scale and impact.

Our Aim

SafeHorizon aims to tackle the emerging threat of Crime-as-a-Service (CaaS) by harnessing intelligence from various sources including the clear web, deep web, dark web, public dumps, and law enforcement datasets. By integrating these data streams with machine learning technologies, the project seeks to extract actionable evidence for legal use.

Use Cases

Monitoring transnational crime networks

Monitoring activities of actors in crime networks including ongoing malicious campaigns that may span across different jurisdictions and developing a set of dedicated crawlers which will provide insight and visibility of real-time activity of malicious online activity.

Criminal marketplace analysis

In order to assess the efficacy of the crawlers and the correlation engine, this use case is dedicated to the analysis of criminal marketplaces, and includes testing of the usefulness of SafeHorizon tools to identify crime networks and investigate their members.

Child sexual abuse and trafficking

This use case presents a comprehensive overview of the distribution channels and of the release dates of child sexual abuse material (CSAM).

Malware-as-a-Service

Malware-as-a-Service (MaaS) is a business model under which cybercriminals provide access to malicious software and related infrastructure for a fee, and in this use case we monitor and analyse ongoing malicious campaigns that may target organisations or individuals.

Partners

Coordinated by the Athena Research Center, SafeHorizon is a multidisciplinary research and development initiative spearheaded by an international consortium comprising 13 partners from 11 countries. Carefully selected consortium is gathering outstanding R&D centers and universities, businesses and Law enforcement agencies (LEAs) to ensure the perspective of developers, cybersecurity practitioners, researchers, and machine learning experts focusing on technical areas between security and development. Committed to contributing to cybercrime prevention improvement, the Consortium will ensure provision of a comprehensive toolbox of underdevelopment and enhanced open-source solutions for combating cybercrime designed to be user-friendly and easily adaptable.

Latest News

  • 22 July 2026|Blog|7.3 min|

    From ClickFix to Crypto Theft: Inside a Tor-Routed, Multi-Module Windows Crimeware Kit

    ClickFix turns fake troubleshooting steps into a gateway for a modular crimeware platform. Behind a decoy Windows layer, an encrypted Python core enables persistence, theft, remote access, and WordPress attacks.

  • 22 June 2026|Blog|3 min|

    SafeHorizon as a Crisis Management Facilitator

    As cyber threats increasingly drive real-world crises, SafeHorizon helps security agencies turn cyber intelligence into actionable insights, strengthening preparedness, response, and resilience against evolving Crime-as-a-Service ecosystems.

  • 15 June 2026|Blog|2.6 min|

    What Is a Fine‑Tuned LLM for Crime Network Analytics?

    Criminal networks are increasingly adaptive, spanning physical and digital domains and evading traditional detection methods. Fine-tuned LLMs help analysts detect hidden patterns and relationships in complex, high-volume data.

  • 21 May 2026|Blog|0.9 min|

    Ofcom and Protect Children published the “CSAM Perpetrator Research Report”

    Ofcom and Protect Children published the "CSAM Perpetrator Research Report", which explores how perpetrators use and exploit digital platforms and services designs to view, host and distribute this type of content.

  • 12 May 2026|Blog|2.3 min|

    Understanding Dark Web Hacking Fora

    Dark web hacking forums play a significant role in the cybersecurity ecosystem, serving as hidden spaces where cybercriminals exchange tools, tactics, and stolen data. Understanding how these communities operate offers valuable insight into emerging cyber threats and the evolving digital risk landscape.

  • 9 April 2026|Blog|1.9 min|

    Unlocking the Value of EU Security Research: The LEA Projects Cluster Approach

    The LEA Projects Cluster, led by Privanova, unites 51+ EU projects to connect results, foster collaboration, and deliver coordinated, policy-relevant security outcomes.

  • 24 February 2026|Blog|5.9 min|

    Spain’s Situation in the Cyberspace Domain

    In recent years, the volume of cyberattacks in Spain has shown an increasing trend. According to the National Cybersecurity Institute (INCIBE), 97,348 cybersecurity incidents were managed in 2024, representing an increase of 16.6 % over the previous year.

  • 16 February 2026|Blog|2.1 min|

    Quantum‑Aware Security: Preparing Europe’s Law Enforcement for the Next Technological Disruption

    Quantum technologies are set to transform Europe’s law enforcement landscape, offering powerful new tools while challenging the very encryption systems that safeguard today’s data and communications.

  • 10 February 2026|Blog|1 min|

    Public-Private Collaboration: A Blueprint for Disrupting Criminal Infrastructure on the Blockchain

    Public-private collaboration offers a model for combining technical expertise, intelligence, and investigative authority to effectively disrupt criminal infrastructure.

  • 6 February 2026|Blog|2.6 min|

    Data Harvesting for CaaS Detection: Turning Digital Clues into Actionable Intelligence

    Data harvesting for CaaS detection is about gathering signals from multiple layers of the digital environment - network traffic, dark web fora, malware telemetry, social platforms, and encrypted communication channels - and transforming them into operational intelligence.

Events

  • 4 August 2026|Events|2.6 min|

    Insights from the First WG1 Policy Scoping Brief on Cyber and Digital Crime

    The first Policy Scoping Brief of the LEA Projects Cluster Working Group on Cyber and Digital Crime examines the gap between the development of security solutions and their effective use in law enforcement practice.

  • 2 June 2026|Events|2.6 min|

    CTB 2026 in Rome | Cryptography, Blockchains, and Why It Matters for Law Enforcement

    On May 9, 2026 GiCP co-organised the third edition of the Workshop on Cryptographic Tools for Blockchains (CTB 2026), held in Rome as a satellite event of Eurocrypt 2026, one of the flagship venues of the International Association for Cryptologic Research.

  • 4 May 2026|Events|1.7 min|

    Operational Challenges in Digital Security: Joint Takeaways from the LEA Projects Cluster

    On 26 March 2026, the LEA Projects Cluster, led by Privanova and KEMEA, gathered EU security projects, law enforcement, and researchers to address gaps in digital security.

  • 18 February 2026|Events|2.5 min|

    Law Enforcement Innovation & Synergies Workshop, organised by the LEA Projects Cluster

    On 29 January 2026, the LEA Projects Cluster organised an LEAs-only online meeting, focused on law enforcement innovation and synergies.

  • 28 January 2026|Events|0.4 min|

    SafeHorizon featured at the Pitch Match Innovation Forum (PIMIF) organised by CEPOL

    Constantinos Patsakis, the Coordinator of the SafeHorizon Project, participated in the Pitch Match Innovation Forum (PIMIF) organised by CEPOL on 28 January 2026 at their headquarters in Budapest, Hungary.

  • 20 December 2025|Events|0.4 min|

    SafeHorizon featured at 8th International Course on Risk and Crisis Management

    Genny Dimitrakopoulou from KEMEA presented SafeHorizon to the 8th International Course on Risk and Crisis Management, hosted by the Geneva Centre for Security Policy (GCSP) with the support of the Federal Office for Civil Protection (FOCP) and the Permanent Representation of Switzerland to NATO. 

  • 28 October 2025|Events|3.6 min|

    Privanova and SafeHorizon Hosted the LEA Projects Cluster Meeting for Cybersecurity Awareness Month

    The LEA Projects Cluster held its online meeting on 24 October 2025. The event took place under the European Cybersecurity Month initiative and featured contributions from INTERPOL and leading Horizon Europe projects.

  • 27 October 2025|Events|0.6 min|

    Joint Stakeholder Workshop – PRESERVE, SafeHorizon, ENSEMBLE, and LEA Projects Cluster

    We invite you to a joint stakeholder workshop organised by PRESERVE, SafeHorizon, and ENSEMBLE, together with the LEA Projects Cluster, led by Privanova.

  • 15 July 2025|Events|0.7 min|

    Privanova and SafeHorizon Hosted the LEA Projects Cluster Meeting

    On 15 July, Privanova and SafeHorizon Project hosted the second LEA Projects Cluster meeting online, bringing together all members to review achievements and plan next steps.

  • 24 June 2025|Events|0.6 min|

    Privanova Presents SafeHorizon at UNODC

    The SafeHorizon Project EU was recently presented at the UNODC Constructive Dialogue on Technical Assistance and International Cooperation by Farhan Sahito, partner at Privanova.