From 7 to 10 September 2026, the Council of Europe, together with Team Cymru, its longstanding partner, co-organised the seventh edition of the Underground Economy Conference in Strasbourg, France. Building on its role as a global hub for law enforcement, cybersecurity professionals, private industry, financial institutions, international organisations, and academia, this year’s programme offered participants the opportunity to engage in plenary sessions, specialised tracks, practical workshops, exclusive training, and practitioner-led discussions addressing the latest advances in cybercrime investigations.
In opening the conference, the Director General of Human Rights and Rule of Law of the Council of Europe, Mr. Gianluca Esposito, highlighted that technology alone is not enough to address the growing reach of cybercrime. What is needed is coordinated action grounded in robust legal frameworks, notably the Convention on Cybercrime (Budapest Convention) and its Second Additional Protocol, supported by trust, rapid operational mechanisms such as the 24/7 Network and structured public-private partnerships
The 2026 programme addressed a wide spectrum of cyber threats, including ransomware, financial fraud, phishing, infostealers, cryptocurrency crime, botnets, residential proxies, nation-state espionage, and the misuse of artificial intelligence. Sessions highlighted emerging risks such as AI-powered fraud, real-device automation, fake remote workers, mobile spyware, and the abuse of legitimate platforms and services.
A distinctive feature of this year’s edition was its strong focus on artificial intelligence and its impact on both criminal activity and cybercrime investigations, with discussions spanning agentic cybercrime, AI-assisted threat intelligence, autonomous intrusions, AI-generated child sexual abuse material, and the underground market for stolen AI access. Participants benefited from hands-on workshops and dedicated sessions where AI and open-source intelligence (OSINT) were applied to real-world investigative scenarios.
Throughout the event, operational disruption and public-private co-operation were at the forefront. Case studies showcased international takedowns and the dismantling of cybercrime-as-a-service networks, botnet infrastructures, bulletproof hosting, DDoS-for-hire supply chains, residential proxy systems, and illicit online marketplaces. Practical demonstrations illustrated the integration of threat intelligence, digital forensics, blockchain analytics, network telemetry, OSINT, and international co-operation to trace criminal infrastructure, follow illicit financial flows, secure evidence, and support coordinated enforcement action.
The discussions also examined the evolving ecosystem of cybercrime, highlighting its convergence with cybersecurity, data privacy and influence operations. The practical presentations facilitated sharing operational experience, strengthening practitioners’ networks, and the turning expertise into joint action against cybercrime.
During the closing ceremony, Ms. Hanne Juncher, the Director of Security, Integrity and Rule of Law emphasised that the real-world effects of cybercrime extend beyond technical, legal, and co-operative dimensions to encompass significant societal and institutional ramifications. For this reason, the real success of the event will be measured by the co-operation and practical results that follow, not only by the quality of discussions held during the conference.
As the global cybercrime landscape continues to evolve, the Underground Economy Conference remains a key platform for co-operation. By bringing together experts from diverse sectors and regions, the event fosters trust-based partnerships to strengthen the collective response to cybercrime.
Convention on Cybercrime (Budapest Convention)
Second Additional Protocol to the Cybercrime Convention
24/7 Network established under the Convention on Cybercrime