ECHO · Nationals
UND CyberHawks National CTF · FinalsQualified for Nationals
ECHO will be at the Finals in person, competing. The club full cleared the virtual qualifiers, ten flags out of ten, and earned a seat at the championship round, held October 26 at the University of North Dakota, as part of the IEEE Cyber Awareness & Research Symposium. The roster travels to Grand Forks to play it on site.
Qualifiers ran September 12 on the Hack The Box platform, a fifteen hour ranked jeopardy, officially AI assisted, run by UND’s Center for Cyber Security Research. ECHO cleared every category: web, crypto, reversing, forensics, hardware, ICS, AI and ML, securing a spot in the in person Finals on October 26, 2026, from 1:30 to 4:30 PM at the University of North Dakota.
ECHO · Mission clock
Counting down to the Finals
The organisers publish the date and the afternoon window. No time zone is stated anywhere upstream, so the clock below counts days and says why, rather than inventing an instant nobody published.
ECHO · Records
Records
Select a record to expand
ECHO · The roster
Who is competing
Teams are up to four players, and ECHO is fielding a full four.
Select a player for their card
ECHO · What the berth includes
What the berth covers
- Hotel for competing players. Complimentary rooms for in person finalists, provided by C2SR at UND. Booking runs through the organisers’ hotel allocation form.
- Conference registration for the team, including access to the symposium’s sessions.
- A finalist workshop seat. In person finalists get a free seat in the Fortinet “Attack & Defense Methodologies” workshop or the Rust Foundational workshop, plus a federated learning workshop run by Flower Labs.
- Travel to Grand Forks. Getting there from Colorado is the team’s own arrangement. See below.
Finalists also get on stage recognition, team photos, certificates, and direct time with mentors, recruiters and faculty.
ECHO · The event
Where and when
| Finals | October 26, 2026 · 1:30 to 4:30 PM |
|---|---|
| Venue | Small Henry Ballroom, UND Memorial Union 2901 University Ave, Grand Forks, ND 58202 |
| Format | Jeopardy style, in person. Teams of up to four. Points by difficulty and accuracy, a bonus for solving quickly, ties broken on submission time. |
| Categories | Web exploitation, cryptography, digital forensics, reverse engineering, binary exploitation, and miscellaneous (OSINT, steganography, scripting). |
| Host | The Center for Cyber Security Research (C2SR), College of Engineering & Mines, University of North Dakota. |
| Symposium | The 6th IEEE Cyber Awareness & Research Symposium (CARS 2026), October 26 to 28, in person and hybrid on the 26th and 27th, fully online on the 28th. An NSA CAE-R conference. |
Prizes
| Place (university category) | Prize |
|---|---|
| 1st | $1,000 |
| 2nd | $700 |
| 3rd | $500 |
Up to $10,000 in total prizes across all categories. Sponsors add digital badges and certificates through Credly, and platform vouchers through SkillBit.
ECHO · The challenges
Challenge categories
The Finals span the same domains ECHO swept in the qualifiers. What each category asks for:
Web Exploitation
Find and exploit vulnerabilities in web applications, including SQL injection, XSS, CSRF, and authentication bypasses.
Cryptography
Break ciphers, analyze cryptographic protocols, and exploit implementation flaws in encryption systems.
Digital Forensics
Analyze disk images, memory dumps, network captures, and file artifacts to uncover hidden evidence.
Reverse Engineering
Disassemble and analyze binaries to understand program behavior, find vulnerabilities, and extract secrets.
Binary Exploitation
Exploit buffer overflows, format strings, and other memory corruption vulnerabilities in compiled programs.
Miscellaneous
OSINT, steganography, scripting, and creative problems that span multiple domains.
ECHO · The symposium
Three days at CARS 2026
The Finals sit inside the 6th IEEE Cyber Awareness & Research Symposium, an NSA CAE-R conference hosted by UND’s Center for Cyber Security Research. It runs October 26 to 28, in person and hybrid on the 26th and 27th and fully online on the 28th.
| Mon Oct 26 | Competition day. Opening keynotes on satellite cyber risk, the limits of AI in critical infrastructure, and federated scientific computing, then a federal funding panel. The CTF Finals run 1:30 to 4:30 PM. Dinner and awards that evening. |
|---|---|
| Tue Oct 27 | Workshop day. A UND quantum panel featuring Scott Aaronson, then the workshops open to finalists: Fortinet’s Attack & Defense Methodologies and a three part Rust workshop, plus a critical infrastructure OT security session. |
| Wed Oct 28 | Online day. Morning paper sessions, then a Flower Labs federated learning and agentic AI workshop and a session on cybersecurity in the age of AI assistants. |
Your finalist workshop access. An in person seat in either the Fortinet Attack & Defense workshop or the Rust workshop on Tuesday, plus the Flower Labs federated learning workshop online on Wednesday. Conference registration and hotel are covered for competing finalists.
Times, rooms and speakers are the organisers’ and subject to change. The full program is on the CARS site.
ECHO · Getting there
Colorado to Grand Forks
This is a real trip, not a drive across town. Fort Collins to Grand Forks is roughly 900 miles. The practical options are flying into Grand Forks International (GFK), usually connecting through Minneapolis St. Paul, or driving it over two days. Free visitor parking is available in Lot 5 next to the Memorial Union.
Specific flights, dates and who books what are being worked out with the team and are not published here. Roster members: those details live in the team channel.
ECHO · The road here
How the seat was earned
217 teams entered the virtual qualifiers. ECHO solved all ten challenges, placed 34th, and finished inside the field invited to compete in person. The full clear is the part worth keeping: every category, no gaps.
Three of the qualifier challenges are written up for anyone who wants to learn the method rather than the answer, a malicious macro read statically, an industrial protocol whose encryption was never the weak link, and a Go binary built to defeat reverse engineering that gave up its secret at runtime.
ECHO · Ethical Cybersecurity Hackers Ops
Front Range Community College
ECHO is FRCC’s student cybersecurity club. If you want to compete, the roster opens for every event, no experience required, and the club will teach you the rest.