Dacia Team Competes at RoCSC Finals 2026

I competed at RoCSC Finals 2026 (Romanian Cyber Security Challenge), achieving 3rd place in the Jeopardy category and 4th place in Attack & Defense. The competition was held at the iconic Palace of the Parliament in Bucharest on May 6-7, 2026.

The Venue

Competing at the Palace of the Parliament was an experience unlike any other. One of the largest administrative buildings in the world, it provided a dramatic and prestigious backdrop for Romania’s premier cybersecurity competition. The setting underscored the national importance of cybersecurity and made the entire event feel special.

Competition Format

RoCSC Finals featured a unique dual-format structure:

Day 1: Jeopardy-Style CTF

The first day focused on traditional Jeopardy-style challenges across multiple categories:

• Web Exploitation — Finding and exploiting web application vulnerabilities
• Binary Exploitation — Memory corruption and reverse engineering
• Cryptography — Breaking encryption and cryptographic protocols
• Forensics — Digital investigation and evidence analysis
• Miscellaneous — Creative problem-solving challenges

I secured 3rd place in this portion, demonstrating strong performance across diverse challenge categories.

Day 2: Attack & Defense

The second day introduced the Attack & Defense format, a radically different competition style:

• Each team receives identical sets of vulnerable services
• Teams must defend their services by finding and patching vulnerabilities
• Simultaneously, teams attack other teams’ services to steal flags
• Real-time scoring based on both defense and offense
• Network-level gameplay requiring quick thinking and adaptation

I finished 4th place in Attack & Defense, my first exposure to this intense competition format.

Day 1: Jeopardy Challenges

Morning Session

We started strong, quickly solving several challenges in web exploitation and cryptography. Our preparation was evident as we efficiently tackled problems we’d trained for.

A particularly satisfying moment came when we solved a complex buffer overflow challenge that stumped many teams, demonstrating our solid foundation in binary exploitation.

Afternoon Push

As difficulty ramped up, we focused on maximizing points by strategically choosing which challenges to tackle. The forensics category proved more challenging than expected, but we persevered and secured valuable points.

By the end of Day 1, we held 3rd place on the Jeopardy leaderboard.

Day 2: Attack & Defense

The Setup

Day 2 brought an entirely new challenge: Attack & Defense. This format was completely different from anything we’d done before:

• Each team managed vulnerable web services on isolated networks
• Flags were automatically injected into vulnerable services every few minutes
• We had to defend our services while stealing flags from other teams

The Reality

The Attack & Defense format was intense:

• Pressure: Real-time attacks meant services could go down at any moment
• Multitasking: Defending, attacking, and patch management all happened simultaneously
• Adaptation: Strategies had to change constantly based on what worked and what didn’t
• Speed: Quick analysis and exploitation were essential

Our Performance

We approached A&D systematically:

1. Initial Analysis — Quickly audited our services to find obvious vulnerabilities
2. Priority Patching — Fixed the most critical issues first
3. Offensive Operations — Developed exploits against other teams’ services
4. Monitoring — Watched for incoming attacks and service availability

Despite it being our first A&D competition, we held our own and finished 4th place, learning immensely in the process.

Key Takeaways

Technical Skills

• Patch Development: Creating fixes under time pressure
• Exploit Development: Quickly weaponizing vulnerabilities
• Network Defense: Monitoring and responding to real-time attacks
• Service Management: Maintaining availability while under attack

Soft Skills

• Stress Management: Operating effectively under high pressure
• Quick Decision-Making: Choosing between competing priorities in real-time
• Team Coordination: Communicating rapidly and clearly during intense moments
• Adaptability: Adjusting strategy based on real-time feedback

The Competition

RoCSC Finals brought together the best cybersecurity talent in Romania. The level of competition was extremely high, with teams demonstrating impressive technical skills and strategic thinking.

The dual-format structure — combining traditional Jeopardy with Attack & Defense — ensured that success required both deep technical knowledge and the ability to apply that knowledge under pressure in dynamic scenarios.

What We Learned

This competition was transformational for our team:

1. Real-World Skills: A&D format mimics actual offensive and defensive security operations
2. Versatility: Success in cybersecurity requires skills across multiple domains
3. Resilience: Maintaining performance when things go wrong (services crash, exploits fail, etc.)
4. National Level: Understanding what it takes to compete at Romania’s highest level

Looking Forward

RoCSC Finals 2026 pushed us harder than any previous competition. The experience of competing at the Palace of the Parliament, combined with the intense A&D format, has prepared us for future challenges in ways traditional CTFs cannot.

We’re proud of our 3rd place finish in Jeopardy and our 4th place finish in Attack & Defense. More importantly, we’re excited about what we learned and how we’ve grown as a team.

Thank you to the RoCSC organizers for creating such an exceptional competition, and congratulations to all the teams that competed!

— Dacia Team