On April 24–25, 2026, Astana IT University hosted the final stage of AITU CTF 2026 — one of the largest annual cybersecurity competitions in Kazakhstan. The tournament brought together the strongest teams from Kazakhstan and abroad, becoming a large-scale platform for developing practical skills in information security.
AITU CTF 2026 was organized by the Astana IT University
School of Cybersecurity, CyberTech, and the AITU Military Department. The
competition aimed to identify and support talented cybersecurity professionals,
develop applied competencies, promote the CTF movement, and strengthen the
international professional community.
The competition took place in two stages: an online
qualification round and an in-person final at Astana IT University.
International Selection: 839 Teams from Around the World
The AITU CTF 2026 qualification stage was held in March
2026 in Task-based CTF format. During a 12-hour online round, participants
solved challenges across key cybersecurity disciplines: Web Security, OSINT,
Cryptography, Reverse Engineering, and Digital Forensics.
A total of 839 teams from around the world participated
in the qualifying stage, confirming the high international interest in the
competition and its significance for the CTF community. Competition for a spot
in the finals lasted until the very last second: 14 teams simultaneously
achieved the maximum possible score of 3,741 points, and the team mimicats led
the leaderboard based on task completion time.
The high level of the national division was noted separately:
more than half of the Kazakhstani teams successfully scored points,
demonstrating strong preparation against tough international competition. In
terms of disciplines, the WEB category was dominant, accounting for nearly half
of all successful solutions. The Japanese team BunkyoWesterns also stood out,
being the first to solve new challenges three times.
Based on the qualification results, 20 of the strongest
teams advanced to the final: the top 10 teams in the Kazakhstani standings and
the top 10 international teams. Finalists represented Kazakhstan, Japan, South
Korea, Russia, Mongolia, Uzbekistan, Vietnam, and Egypt.
International Composition of Finalists
AITU CTF 2026 united participants from various countries.
Confirmed teams and participants in the final stage included:
Kazakhstan — narxploit, z3rol0g1c, pelmeni, p1k4_squ4d,
clockout, gusteaus, zerotrust, mimicats, 0xhackduch, ctf_enjoyers
Uzbekistan — Team1337, zee
Russia — HackerLab, Cut
Mongolia — hackratic, Kheshig, C47
Japan — BunkyoWesterns
South Korea — Cremit
Vietnam — international bracket finalists
Egypt — international bracket finalists
The Cyber Range Final: Realistic Scenarios and Critical
Infrastructure
The AITU CTF 2026 final stage was held on April 24–25 at
Astana IT University in a cyber range format. Participants were presented with
realistic attack scenarios targeting infrastructure and critical facilities.
Unlike classic competitions, the final required teams not
only to demonstrate technical knowledge, but also a comprehensive approach:
analyzing large-scale infrastructure, identifying vulnerabilities, assessing
risks, developing attack strategies, and properly documenting findings.
During the final, participants worked with the
infrastructure of a virtual city called HackCity. Out of six city facilities,
the hospital was successfully compromised: teams executed scenarios involving
patient data leaks and power outages. In total, 8 unique risks out of 19
embedded critical events were realized, and 16 teams managed to execute at
least one risk.
The final program also included special tracks:
GEOINT / GeoGuessr — a tournament in geospatial
intelligence and open-source data analysis
Hardware challenges — practical tasks including cracking
an NFC card and analyzing and exploiting Bluetooth-controlled devices
Seven teams successfully completed the hardware
challenges, highlighting the importance of practical skills in hardware as well
as software security.
AITU CTF 2026 Finals Winners
The final stage results produced the following rankings:
🥇 1st place — Team1337, Uzbekistan | 33,085 points |
Prize: 1,000,000 KZT
🥈 2nd place — HackerLab, Russia | 29,025 points | Prize:
500,000 KZT
🥉 3rd place — ctf_enjoyers, Kazakhstan | 26,418 points |
Prize: 300,000 KZT
4th place — mimicats, Kazakhstan | 23,011 points |
Commemorative prizes
5th place — Kheshig, Mongolia | 22,569 points |
Commemorative prizes
GeoGuessr tournament winners:
🥇 1st place — C47, Mongolia
🥈 2nd place — zee, Uzbekistan
🥉 3rd place — Z3rol0g1c, Kazakhstan
Partner and Sponsor Support
AITU CTF 2026 was made possible with the support of
competition partners and sponsors: Kaspersky, Palo Alto Networks, iBatyr,
RTEAM, TSARKA, tLab, Cyber Tech, NRC, and the Astana IT University Military
Department.
CTF as a Practical Training Format
CTF, or Capture The Flag, is a practice-oriented
cybersecurity competition format. Participants solve real technical challenges
across various disciplines: web security, cryptography, digital forensics,
OSINT, reverse engineering, vulnerability exploitation, steganography,
blockchain, and hardware security.
The key difference between CTF and classical competitions
lies in the applied nature of the tasks. It is not only a test of theoretical
knowledge, but hands-on work with real tools, attack models, infrastructure
scenarios, and technical cases.
AITU as a Center for Practical Cybersecurity Development
The CTF movement has been actively developing at Astana
IT University since 2021. During this time, university students have formed a
strong professional community, proudly represented AITU and Kazakhstan on the
international stage, and participated in cybersecurity competitions in the USA,
France, Italy, Saudi Arabia, Thailand, Tunisia, Russia, Turkey, Uzbekistan,
South Korea, and other countries.
In recent years, more than 10 competitions of various
levels have been held at Astana IT University, including international
tournaments with teams from different countries around the world.
AITU CTF 2026 united talented participants, strong
international teams, and a practice-oriented approach to education. The
tournament demonstrated that modern cybersecurity demands not only deep
technical knowledge, but also strategic thinking, teamwork, analytical skills,
and the ability to act effectively in the face of real digital threats.