ICO Uzbekistan 2026 Final Round

The ICO Uzbekistan 2026 Final Round is the final national selection stage for identifying the strongest cybersecurity students in Uzbekistan.

Because the international final is approaching and many finalists are travelling from different regions of Uzbekistan, the Organizing Committee has decided to combine the second and third stages into one full competition day.

The final day will consist of two independent stages:

The schedule below reflects the expected order of the final day. Exact times will be confirmed by the Organizing Committee. Participants must be ready to follow on-site instructions at all times.

1. Step 01

   Participant arrival and identity / registration check

   Finalists arrive on-site, present any required ID, and complete check-in.

2. Step 02

   Technical preparation and laptop / environment verification

   Setup, network, and environment checks before official credentials are issued.

3. Step 03

   Distribution of personal access tokens and CTFd credentials

   Each finalist receives personal credentials. These are confidential and one-time use.

4. Step 04

   Opening briefing and rule explanation

   Final review of rules, anti-cheating policy, AI policy, and on-site instructions.

5. Stage 1

   Terminal-Based Cybersecurity + AI Challenge — 1.5 hours

   Round 2 of ICO Uzbekistan 2026, executed inside the official CLI environment.

6. Step 06

   Break and lunch

   Lunch is provided for all finalists. Use the time to rest before Stage 2.

7. Stage 2

   Classic CTF Competition on CTFd — 4 hours

   Round 3 of ICO Uzbekistan 2026, conducted on the official CTFd platform.

8. Step 08

   Result verification and integrity checks

   Submission analysis, anti-cheating review, and result verification by the committee.

9. Step 09

   Award ceremony

   Recognition of medalists and presentation of certificates to all finalists.

10. Step 10

    Closing and departure

    Official closing of the Final Round and departure of participants.

Stage 1 is a new-generation cybersecurity competition format built around terminal-native interaction and AI security. Participants will work inside a dedicated CLI environment. The purpose of this stage is to test how well students can operate in a command-line environment, understand cybersecurity tasks, communicate with AI systems, control AI assistance, and solve AI-security challenges.

Participants will receive a personal token during registration. This token will be used to start the terminal-based exam. Tokens are personal, one-time use, and must not be shared with anyone.

The terminal stage may include

• AI-assisted cybersecurity questions
• AI-as-a-teammate tasks
• AI-as-a-target tasks
• Prompt-injection-style tasks
• AI defense tasks
• AI behavior analysis
• Terminal command usage
• Basic scripting or command-line reasoning
• Cybersecurity theory and applied tasks
• Interaction with task-specific LLMs

How the Terminal Stage Works

1. The participant receives a personal token from the Organizing Committee.
2. The participant opens Terminal / cmd / PowerShell / WSL / Linux terminal according to their system.
3. The participant starts the CLI.
4. The participant selects the correct competition mode if required.
5. The participant enters the official exam command with their token.
6. The timer starts.
7. The participant solves tasks inside the terminal environment.
8. The participant submits answers through the official interface.
9. After final submission or timeout, the token is considered used.
10. The Organizing Committee receives the official result.

The technical format is based on the official ICOA CLI-style national selection workflow adapted for ICO Uzbekistan 2026. The standard flow is:

Install Node.js→ Install the CLI→ Start the CLI→ Run demo→ Use exam token only when instructed

General Requirements

• Laptop with stable battery / charger
• Internet connection
• Node.js installed
• Terminal access
• Ability to run npm commands
• Python 3 may be required for some advanced tasks or tools
• Participants should bring their own laptop unless the Organizing Committee announces otherwise
• Participants should test installation before the competition if possible
• On-site technical support may be available, but participants remain responsible for bringing a usable device

npm install -g icoa-cli@<version>

chcp 65001

sudo apt update
sudo apt install -y nodejs npm

sudo apt update
sudo apt install -y curl
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt install -y nodejs

node --version
npm --version

sudo npm install -g icoa-cli@latest

icoa

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
source ~/.bashrc
nvm install 22
nvm use 22
npm install -g icoa-cli@latest

icoa — Start the CLI.
demo — Open practice/demo mode if available.
exam <token> — Start the official exam using the personal token provided by the Organizing Committee.
ref — Show the command reference inside the exam environment.
lang <code> — Change interface language if supported, for example lang en.
submit — Submit answers through the official interface.
back — Return to the previous screen or question where supported.
help — Show help or cancel a pending answer depending on the current mode.
ICOA_RESET_STATE=1 icoa — Proctor-only reset command for verified technical incidents.

Use this checklist to make sure you are ready on the day of the Final Round.

• Read this entire page carefully.
• Bring your laptop.
• Bring your charger.
• Charge your laptop fully.
• Install Node.js in advance if possible.
• Make sure terminal / cmd / PowerShell works.
• Make sure npm works.
• Test the CLI demo if available.
• Make sure your keyboard works properly.
• Make sure your operating system is stable.
• Make sure you can connect to Wi-Fi.
• Do not share your access credentials.
• Arrive on time.
• Bring any required ID or confirmation if announced by the Organizing Committee.
• Inform your parents about the full-day schedule.
• Be ready to stay until the evening.

Stage 2 is the classic cybersecurity CTF round of the ICO Uzbekistan 2026 Final Round. It will be conducted on the official CTFd platform using individual accounts provided by the Organizing Committee.

Possible Challenge Categories

How CTFd Works

• Participants log in with their personal username and password.
• Each challenge has a title, category, point value, description, and expected flag format.
• Participants solve challenges and submit flags.
• Correct submissions receive points.
• Incorrect submissions may be logged.
• Some challenges may have hints.
• Hints may reduce points if the platform is configured that way.
• The scoreboard may be visible or hidden depending on the Organizing Committee's decision.
• The Organizing Committee may add, update, clarify, disable, or adjust challenges if needed.
• Final ranking is determined by official platform results and Organizing Committee verification.

Flag Rules

• Submit flags exactly in the required format.
• Do not add extra spaces.
• Do not change capitalization unless the challenge says otherwise.
• Do not share flags with anyone.
• Do not ask for flags.
• Do not post flags in the group.
• Do not submit flags received from another participant.

All finalists are required to follow the rules listed below. Acceptance of these rules is a precondition for participation in the Final Round.

1. Individual competition

   All participants compete individually. Teamwork is not allowed unless explicitly announced.

2. No flag sharing

   Sharing, receiving, requesting, buying, selling, hinting, leaking, or indirectly communicating flags is strictly prohibited.

3. No solution sharing

   Participants may not share methods, scripts, screenshots, terminal output, partial solutions, challenge files, or exploit steps during the competition.

4. No external collaboration

   Participants may not communicate with friends, teachers, parents, online communities, Telegram groups, Discord servers, forums, or other participants for help during the contest.

5. No unauthorized AI

   Only official AI tools provided or approved by ICO Uzbekistan 2026 may be used.

6. No unauthorized websites during Stage 1

   Stage 1 is terminal-only unless the Organizing Committee explicitly allows something else.

7. CTFd restrictions

   Participants must use only their own assigned CTFd account.

8. Token restrictions

   Terminal tokens are personal and one-time use.

9. Device integrity

   Participants must use only approved devices. Additional phones, hidden devices, second laptops, or unauthorized communication tools may be restricted or banned during competition time.

10. Screen recording / monitoring

    The Organizing Committee may require screen recording, random checks, device checks, browser history checks, terminal history checks, or post-contest interviews for selected participants.

11. Post-contest verification

    The Organizing Committee may request explanations, writeups, interviews, or live re-solving for selected participants before confirming final results.

12. Suspicious behavior

    Unusual submission patterns, impossible solve times, copied flags, identical behavior, suspicious traffic, or evidence of collaboration may trigger investigation.

13. Final authority

    All final decisions are made by the ICO Uzbekistan 2026 Organizing Committee.

14. Rule updates

    The Organizing Committee reserves the right to update, clarify, modify, add, or remove rules before, during, or after the competition if needed for fairness, security, technical stability, or organizational reasons.

15. Technical incidents

    If a real technical issue occurs, the participant must immediately notify a proctor or organizer. Silent complaints after the contest may not be accepted unless there is strong evidence.

16. Late arrival

    Late participants may lose competition time or may not be admitted, depending on the Organizing Committee's decision.

17. Final submission

    Submission is final. Once submitted or auto-submitted, attempts may not be reopened unless the Organizing Committee decides otherwise due to a verified technical issue.

18. Respectful behavior

    Participants must behave respectfully toward organizers, proctors, partners, and other participants.

19. Confidentiality

    Internal final-round information, access credentials, tasks, files, tokens, screenshots, and private instructions must not be shared outside the finalist group unless officially published.

20. Acceptance of rules

    By participating in the final round, the participant confirms that they have read, understood, and accepted all rules on this page and all additional instructions given by the Organizing Committee.

On the competition day, each participant will receive personal credentials.

The final ranking may consider performance across both stages. Exact scoring rules, tie-break rules, and final ranking methodology may be announced by the Organizing Committee before or during the final round.

Tie-breakers may include

• Total score
• Earlier final solve time
• Number of solved challenges
• Performance in selected priority challenges
• Post-contest verification
• Organizing Committee review

The following medals will be awarded based on final verified results:

The following common issues are pre-answered. For anything else, contact an on-site proctor.

chcp 65001

sudo npm install -g icoa-cli@latest

ICO Uzbekistan 2026 is a national cybersecurity selection process organized in cooperation with relevant educational and olympiad partners, including the Ministry of Preschool and School Education and the Science Olympiad Center.

The Top 55 finalists are among the strongest cybersecurity students in Uzbekistan. The final round is an important step toward identifying the national team and recognizing the country's strongest young cybersecurity talents.

The final day may last from morning until evening. Lunch will be provided. Participants travelling from regions should plan transportation accordingly.

If parents have questions, they may contact the Organizing Committee through the official communication channels announced to finalists.

The ICO Uzbekistan 2026 Organizing Committee reserves the right to:

• Update the schedule
• Modify rules
• Clarify unclear situations
• Adjust technical procedures
• Change platform settings
• Add or remove challenges
• Freeze or hide the scoreboard
• Investigate suspicious behavior
• Request screen recordings, interviews, or writeups
• Cancel invalid submissions
• Disqualify participants for rule violations
• Make final decisions on ranking, medals, certificates, and national team selection