On April 24–25, 2026, Astana IT University hosted the final stage of AITU CTF 2026 — one of the largest annual cybersecurity competitions in Kazakhstan. The tournament brought together the strongest teams from Kazakhstan and abroad, becoming a large-scale platform for developing practical skills in information security.

Astana IT University and FR13NDS TEAM organized the competition. AITU CTF 2026 aimed to identify and support talented cybersecurity specialists, develop applied competencies, promote the CTF movement, and strengthen the international professional community.

The competition was held in two stages: online qualification and an in-person final at Astana IT University.

International qualification: 839 teams from around the world

The qualification stage of AITU CTF 2026 took place in March 2026 in a Task-based CTF format. During the 12-hour online round, participants solved challenges in key areas of cybersecurity: Web Security, OSINT, Cryptography, Reverse Engineering, and Digital Forensics.

A total of 839 teams from around the world took part in the qualification stage, confirming strong international interest in the competition and its importance for the CTF community. The competition for a place in the final remained intense until the very last seconds: 14 teams scored the maximum possible 3,741 points, while the team mimicats became the leaderboard leader by challenge completion time.

The high level of the national division was also noted separately: more than half of the Kazakhstani teams successfully scored points, demonstrating strong preparation amid intense international competition. In terms of disciplines, the WEB category became the dominant area, accounting for almost half of all successful solves. The Japanese team BunkyoWesterns also showed strong performance, being the first to solve new challenges three times.

Based on the qualification results, the 20 strongest teams advanced to the final stage: the top 10 teams in the Kazakhstan division and the top 10 international teams. The finalists included representatives from Kazakhstan, Japan, South Korea, Russia, Mongolia, Uzbekistan, Vietnam, and Egypt. This broad geographical reach gave the final the status of a significant international event in practical cybersecurity.

International composition of the finalists

AITU CTF 2026 brought together participants from different countries and became a platform where the strongest teams from the Kazakhstan and international divisions met. The competition materials specifically highlighted teams and participants from Kazakhstan, Uzbekistan, Russia, Mongolia, and Japan, as well as representatives from South Korea, Vietnam, and Egypt.

Among the confirmed teams and participants of the final stage:

Kazakhstan — ctf_enjoyers, mimicats, Z3rol0g1c
Uzbekistan — Team1337, zee
Russia — HackerLab
Mongolia — Kheshig, C47
Japan — BunkyoWesterns
South Korea — finalists of the international division
Vietnam — finalists of the international division
Egypt — finalists of the international division

The international composition of participants highlighted the high level of competition and confirmed AITU CTF’s status as one of the notable platforms for developing practical competencies in cybersecurity in the region.

Final on the cyber range: realistic scenarios and critical infrastructure

The final stage of AITU CTF 2026 took place on April 24–25 at Astana IT University in a cyber range format. Participants were offered realistic attack scenarios targeting infrastructure and critical facilities.

Unlike classic competitions, the final required teams not only to demonstrate technical knowledge but also to apply a comprehensive approach: analyzing large-scale infrastructure, identifying vulnerabilities, assessing risks, building an attack strategy, and preparing clear reports.

During the final, participants worked with the infrastructure of the virtual city HackCity. Out of six city facilities, the hospital was successfully attacked: teams implemented scenarios related to patient data leakage and power outage. In total, 8 unique risks out of 19 embedded critical events were realized in the final, and 16 teams managed to realize at least one risk.

The final program also included special tracks:

GEOINT / GeoGuessr — a tournament in geospatial intelligence and open-source data analysis;
Hardware challenges — practical tasks involving NFC card hacking, as well as the analysis and exploitation of Bluetooth-controlled devices.

Seven teams successfully completed the hardware challenges, highlighting the importance of practical skills not only in software security but also in hardware security.



Winners of AITU CTF 2026 Finals

Based on the results of the final stage, the prize places were distributed as follows:

1st place — Team1337, Uzbekistan
33,085 points
Prize: 1,000,000 KZT

2nd place — HackerLab, Russia
29,025 points
Prize: 500,000 KZT

3rd place — ctf_enjoyers, Kazakhstan
26,418 points
Prize: 300,000 KZT

4th place — mimicats, Kazakhstan
23,011 points
Commemorative prizes

5th place — Kheshig, Mongolia
22,569 points
Commemorative prizes

The winners of the separate GeoGuessr tournament were:
1st place — C47, Mongolia
2nd place — zee, Uzbekistan
3rd place — Z3rol0g1c, Kazakhstan
Support from partners and sponsors

AITU CTF 2026 was made possible with the support of the competition’s partners and sponsors: Kaspersky, Palo Alto Networks, iBatyr, RTEAM, TSARKA, tLab, Cyber Tech, Research and Innovation Center, as well as the Military Department of Astana IT University.

Their contribution made it possible to organize the competition at a high level and create a practice-oriented platform where young specialists could apply their knowledge in conditions close to real-world challenges of modern cybersecurity.

CTF as a practical format for training specialists

CTF, or Capture The Flag, is a practice-oriented format of cybersecurity competitions. In such competitions, participants solve real technical tasks across various areas: web security, cryptography, digital forensics, OSINT, reverse engineering, vulnerability exploitation, steganography, blockchain, and hardware security.

The main difference between CTF and traditional olympiads is the applied nature of the tasks. It is not only a test of theoretical knowledge, but also work with real tools, attack models, infrastructure scenarios, and technical cases.

That is why AITU CTF 2026 became not just a competition, but a full-fledged practical environment where participants were able to demonstrate technical preparation, teamwork, analytical thinking, and the ability to act in a complex digital infrastructure.

AITU as a center for the development of practical cybersecurity

At Astana IT University, the CTF movement has been actively developing since 2021. During this time, university students have formed a strong professional community, represented AITU and Kazakhstan on the international stage, and participated in cybersecurity competitions in the USA, France, Italy, Saudi Arabia, Thailand, Tunisia, Russia, Turkey, Uzbekistan, South Korea, and other countries.

In recent years, Astana IT University has hosted more than 10 competitions of various levels, including international tournaments with teams from different countries. AITU CTF 2026 once again confirmed that the university is not only an educational platform, but also one of the centers for the development of practical cybersecurity in the region.

AITU CTF 2026 brought together talented participants, strong international teams, and a practice-oriented approach to learning. The tournament showed that modern cybersecurity requires not only deep technical knowledge, but also strategic thinking, teamw