COUNTERCRAFT SL

Their core work

CounterCraft is a San Sebastian-based cybersecurity SME that builds and operates cyber deception platforms — technology that creates realistic fake digital environments to detect intruders, gather threat intelligence, and study attacker behavior. Their core product generates deceptive campaigns across digital infrastructure to lure, track, and profile malicious actors before damage occurs. In parallel, they have deep expertise in cryptocurrency forensics and darknet investigation, contributing analytical tools to law enforcement for tracing transactions across Bitcoin networks and underground markets. They sit at the intersection of offensive cyber intelligence and defensive security operations.

What they specialise in

How they've shifted over time

Both projects fall within the same year (2017), so a meaningful temporal evolution cannot be drawn from project timelines alone. The early-period keyword cluster — virtual currency, cryptocurrency, Bitcoin, darknet, underground markets — belongs entirely to the TITANIUM project, suggesting their H2020 entry was partly shaped by a law enforcement and forensics agenda. The COUNTERCRAFT project, their own flagship, carries no keywords in the dataset but its title and coordinator role signal a parallel and likely more commercially strategic strand: proactive cyber deception for enterprise and intelligence clients. With no later-period projects in the H2020 record, trajectory beyond 2020 cannot be confirmed from this data alone.

CounterCraft appears to be evolving from forensic investigation support toward proactive, product-led cyber deception — a higher-margin, scalable direction that positions them as a technology vendor rather than a research contributor.

How they like to work

CounterCraft has demonstrated both leadership and partnership roles, coordinating their flagship project and participating as a specialist in a larger research consortium. With 15 unique partners across 7 countries from only 2 projects, they engage in moderately sized but internationally diverse consortia rather than tightly closed networks. This suggests they are comfortable bringing their specialized cyber capabilities into multi-disciplinary teams and can both anchor a project and slot in as a focused contributor.

CounterCraft has worked with 15 unique consortium partners spanning 7 countries, a respectable network breadth for a two-project SME. Their geographic spread suggests established relationships across European security research and law enforcement technology communities.

What sets them apart

CounterCraft occupies an unusually specific niche: they are one of very few European SMEs combining a commercial cyber deception product with validated experience in criminal financial intelligence and darknet forensics. This dual positioning — serving enterprise security teams and law enforcement alike — gives them cross-cutting relevance that pure cybersecurity vendors or academic forensics groups cannot match. For a consortium targeting digital crime, financial fraud, or critical infrastructure protection, they bring both a deployable technology asset and deep operational knowledge of how threat actors actually behave online.

Highlights from their portfolio

• COUNTERCRAFT
  Their own flagship project, coordinated with the largest budget (€1.13M), directly reflects their core commercial product — a rare case where H2020 funding aligned with a company's primary market offering.
• TITANIUM
  Placed CounterCraft inside a multi-partner law enforcement research consortium tackling Bitcoin tracing and darknet markets, demonstrating applied forensic expertise beyond their core deception technology.