Dust2 has stayed in the pool through every shake-up this year. The Season 5 bomb-damage rework (blast weakens around corners and stops at walls) also changes how pistol post-plants and CT saves play out. This piece covers the fundamentals, the core T pistol patterns, then team-by-team breakdowns of NAVI, Vitality, Falcons, FaZe, Spirit and FURIA, an IGL comparison, and what you can steal for your own team.

A note on evidence: nobody publishes clean round-by-round T-pistol data per team per map, so each team section pairs sourced 2026 facts (rosters, results, role stats) with a read of how that IGL builds the round. Where a claim is a read rather than a stat, it says so.

The fundamentals: money, loadouts and the CT setups you must beat

Every T starts with $800 and a Glock-18. The whole round is a question of how to split that $800 across five players. The Glock’s strength is close-range spray and running accuracy, which is why Dust2’s short, cornered entries (upper tunnels into B, catwalk onto A) suit it far more than the open long A doors.

Standard T pistol buys

The usual team template is two or three utility buyers, one or two kevlars for the mid and long players, and the lurker on a cheap P250 or a flash. Pros almost never buy five kevlars on Dust2 T pistol, because the hit dies to utility first and to aim second.

The CT setups Ts are hitting into

• 2–1–2 standard: two A (long + short/site), one mid (doors or CT-mid), two B. The most common and the one most T pistols are designed to overload.
• Stacked B (3 B): a third player rotating early through CT/mid-to-B, often with a kevlar and an HE for tunnels. Punishes the classic five-man tunnel rush.
• Aggressive long: a CT pushing to long corner or pit with a flash, aiming to trade a pick early and force the A side to burn time.
• Mid-doors info: a CT smokes or peeks xbox early to see where Ts commit, then calls rotates before the bomb is down.

A good T pistol answers two questions in its first 20 seconds: where is the extra CT, and can we get the bomb down before the rotation lands.

The T pistol playbook: six patterns every top team runs

Almost every elite Dust2 T pistol is a variation on six patterns. What separates teams is timing, who holds the bomb, and what the mid player does.

1. Fast B (the five-man tunnel rush). Everyone through upper tunnels, flash over the B doors/arch, smoke CT/window, molly back plat or car. Wins on speed against a 2-man B; dies to the 3-B stack or an HE in tunnels. Usually bomb down inside 30 seconds.

2. Mid-to-B split. Three in upper tunnels, two take xbox/mid doors with a smoke on the doors, then push lower tunnels or CT-mid to cut the rotator. The best counter to a CT who rotates early from mid.

3. Short A (catwalk) hit. Two to three up catwalk, one long, one lurk mid. Flashes over short, smoke CT spawn, bomb onto default. Glock spray wins the close fights on short boost and the ramp.

4. Long A take. Long doors pushed with a flash and a kevlar entry, a smoke cross for blue/CT, the rest join through long. Slow and money-hungry; mostly run by teams with strong aim on kevlar.

5. A split (long + short). Two long, two short, one mid lurk; the classic Dust2 crossfire hit. Strong vs a 2–1–2 because the A CTs are forced to choose one angle.

6. Fake and fold. Utility and noise on one site (often B tunnels), one or two players stay, the rest rotate through mid to hit the other site late. Only works if the IGL has read the CT rotations in earlier matches.

The mid player is the swing piece in all six. Teams that take mid control early with a kevlar can play the round late and pick the site after seeing rotations; teams that skip mid are betting on speed.

After the plant, the 2026 bomb-damage rework matters: CTs can now survive a detonation at range behind cover, so saving on a lost retake is a little safer and Ts should not assume a late defuse attempt is a kill.

NAVI — Aleksib’s structured overload

NAVI’s T pistol is a rehearsed, utility-first hit where Aleksib spends himself so makazze and b1t can trade into the site. The lineup is Aleksib, iM, b1t, w0nderful and makazze.

2026 so far. NAVI won ESL Pro League Season 23 and IEM Atlanta. On the way they beat Vitality 13–11 on Vitality’s own Dust2 pick. Cologne went badly: NAVI went 0–1 on Dust2 at the Major, and the teamplay that gave them a high floor disappeared while makazze struggled individually.

The roles behind the pistol. Leetify’s Cologne breakdown has makazze leading NAVI in opening duels, Aleksib leading in traded deaths and b1t leading in trade kills. That is the shape of the round: makazze opens, Aleksib takes the second contact and dies traded, b1t cleans up.

What to expect on Dust2 T pistol (our read).

• A prepared hit rather than a default. Aleksib’s teams historically buy more utility than kevlar on pistol and commit to one site early.
• B through upper tunnels is the natural fit: Aleksib or iM throws the CT/window smoke, the doors flash goes for makazze, b1t is the trade.
• w0nderful plays as a Glock rifler, usually on the mid or long kevlar, holding the rotator off rather than entering.
• When it fails it fails on the trade, not the entry — exactly the Cologne problem. If b1t is late, Aleksib’s sacrifice buys nothing.

Vitality — apEX and the best pistol team in the world

Vitality are the benchmark. The roster is unchanged: apEX (IGL), ZywOo, ropz, flameZ, mezii.

2026 so far. Wins at IEM Kraków, PGL Cluj-Napoca, BLAST Open Rotterdam, IEM Rio, BLAST Rivals Season 1, StarSeries Fall and ESL Pro League Season 24. The one big miss was the Cologne quarter-final, where Falcons ended the two-time defending champions’ run — on a Dust2 decider.

Dust2 is not automatic for them. They crushed Spirit 13–5 on Spirit’s own Dust2 pick in the IEM Rio final and FURIA 13–4 at BLAST Open Porto. But they also lost their own Dust2 pick to NAVI in Atlanta and the Cologne decider to Falcons.

The roles behind the pistol. Under apEX, Vitality play around information from flameZ in aggressive areas and ropz lurking on the opposite side.

What to expect on Dust2 T pistol (our read).

• apEX is the classic first-in IGL: he takes the dirty entry with a flash so ZywOo can trade with a Glock.
• ropz’s lurk is the weapon. One player holding lower tunnels or mid on pistol punishes the CT who rotates early, which is why Vitality’s split and late hits work so well.
• flameZ supplies the early contact that tells apEX where the third CT is, and the call follows the information rather than a fixed plan.
• Expect fewer set plays than NAVI and more mid-round calls. That flexibility is why their pistol rate holds up across every map.

Falcons — karrigan’s Major-winning gamble

Falcons won the Cologne Major with a T side on Dust2 that was never their strength: they got there on CT halves, overtime nerve and karrigan’s willingness to give his stars freedom. karrigan left FaZe and joined Falcons in April 2026, reuniting with NiKo and coach zonic. The lineup is karrigan (IGL), NiKo, m0NESY, TeSeS and kyousuke.

2026 so far. A rough debut — a 3–0 loss to Spirit in the PGL Astana final, where karrigan rated 0.66 — then the Major title, beating Vitality, Spirit and FURIA.

Their Dust2 story is all deciders.

• Lost Dust2 to Vitality 6–13 and Spirit 7–13 at IEM Rio, and 12–16 in overtime to Spirit in the Astana final.
• Then won two Major playoff deciders on it: vs Vitality in the quarter-final and vs Spirit in the semi-final.
• The semi-final Dust2 tells the whole story. Falcons started T and won only 5 of 12, took the CT half 7–5, then won overtime 4–0 for a 16–12 finish. Spirit finally won a pistol on that map after losing them earlier in the series.

What to expect on Dust2 T pistol (our read).

• karrigan’s pistols are simple and fast: one site, stacked flashes, and karrigan himself as the first body through the door. His low ratings across the semi-final (0.74 for the series) fit an IGL who dies first on purpose.
• NiKo is the Glock threat. Expect him at the front of short A or out of upper tunnels, where close-range headshots decide the round.
• m0NESY plays pistols for picks, often mid, rather than as an entry.
• The weakness is mid control. On a Dust2 T pistol that skips mid, a single CT rotator through B doors can collapse the hit — the exact pattern Spirit exploited at Rio and Astana.

FaZe — Twistzz rebuilding after karrigan

FaZe’s T pistol in 2026 is a rebuild in progress: a new caller, a new AWPer, and firepower doing more of the work than set pieces. karrigan’s April exit was sudden by Twistzz’s own account, Twistzz took over the calling, and FaZe missed the Cologne Major.

The current five. Twistzz (IGL), frozen, JBOEN, jcobbb and Neityu, coached by enkay J. broky was benched over the summer and BIG Academy AWPer JBOEN signed. Neityu went from stand-in to a permanent deal, described as a selfless piece who needs few resources.

On Dust2. Their marquee Dust2 of the second half was an 11–13 loss to Vitality at the Esports World Cup — close against the best team in the world, which is a fair summary of where FaZe sit.

What to expect on Dust2 T pistol (our read).

• Neityu is the utility carrier and first body on a B hit, freeing frozen and jcobbb to take the trades.
• Twistzz is one of the best Glock headshot players alive, so expect him in the second position on short A rather than calling from the back.
• JBOEN is described as ferociously aggressive. On pistol that points to an early mid or long duel with kevlar.
• The risk is predictability. A newer calling structure tends to repeat its best pistol, and top CT sides will stack for it.

Spirit — magixx builds the round around donk

Spirit’s T pistol is the most player-centred in the elite: everything exists to give donk a flashed duel at the front of the hit. magixx took over the calling for 2026 with zont1x back in the side; the Major lineup was magixx, tN1R, sh1ro, donk and zont1x.

The system change. Spirit used to throw fewer flashes than other teams. In 2026 sh1ro’s and tN1R’s flash output rose, and donk’s opening-kill success jumped from 58.2% in 2025 to 72.9% early in 2026. magixx also takes about 18% of T-side opening duels at 37% success, and his deaths get traded more often than chopper’s did.

On Dust2. It is one of their best maps. In 2026 they beat Falcons 13–7 at IEM Rio and 16–12 in the PGL Astana final, but lost 5–13 to Vitality on their own pick in the Rio final and 12–16 in overtime to Falcons in the Cologne semi-final. At the Esports World Cup they won four Dust2 maps, including a 19–15 overtime against Luminosity.

What to expect on Dust2 T pistol (our read).

• donk on point, every time. The pistol is built so two teammates flash for him out of upper tunnels or over short.
• sh1ro, the AWPer, plays pistol as a support: utility carrier and the trade behind donk, not a second entry.
• magixx floats mid. His job is the early opening or the info that tells donk which site is thin.
• The counter is simple to say and hard to do: stack the site donk is going to and survive the first flash. When Spirit lose pistols, it is usually because donk’s duel came unflashed.

FURIA — FalleN’s hybrid, still solving Dust2

FURIA reached the Cologne Major final, but Dust2 is the map where their T side has looked least finished in 2026. The lineup is FalleN (IGL), yuurih, YEKINDAR, KSCERATO and molodoy, built in 2025 when FalleN gave the AWP to molodoy and moved to rifle to focus on calling.

2026 so far. Runner-up at IEM Kraków and the Cologne Major, fourth at IEM Rio. The Major final was a 3–0 loss to Falcons.

On Dust2. Mixed and recently poor against the very top. Vitality beat them 13–4 at BLAST Open Porto and again on Dust2 at StarSeries Fall, and Falcons took the PGL Astana decider on it. At the Esports World Cup they beat 9z 13–6 and G2 13–4, then lost 13–16 to FUT and 9–13 to Legacy.

What to expect on Dust2 T pistol (our read).

• YEKINDAR is the entry; his Virtus.pro background brings the aggressive first contact FURIA’s naturally passive riflers lacked.
• FalleN calls a structured, mid-first pistol: take xbox and mid doors, then choose the site off the rotation.
• KSCERATO and yuurih are the trade and the anchor of the post-plant — the most reliable part of the round.
• molodoy with a Glock is an unknown quantity for opponents; FURIA tend to use him on the long or mid kevlar for a pick rather than in the stack.
• Against Vitality the mid-first plan has been read and punished. A faster B pistol is the obvious adjustment if FalleN wants a different look.

IGL comparison and the 2026 meta

The six IGLs split cleanly into two camps: callers who build the pistol around a star’s duel (magixx, karrigan, Twistzz) and callers who build it around a structure (Aleksib, apEX, FalleN). apEX’s Vitality sit in the middle — structure with ropz’s lurk as the flex — and they have the best pistol numbers.

The 2026 trends

• The T pistol is an underdog round on Dust2. Across HLTV’s full Dust2 history, Ts win 47.3% of pistols, yet the T pistol winner converts round 2 80.8% of the time. Winning it is rare enough and valuable enough to justify a prepared play.
• Flash support for the star is the new standard. Spirit’s donk numbers moved because teammates started flashing for him, not because he aimed better.
• Dust2 is a decider map. The two biggest Dust2 maps of the year, both Cologne playoff deciders, went to the team that won the CT half and overtime, not the better T pistol.
• Post-plant rules changed in July. With bomb damage now blocked by walls, Ts holding a post-plant can no longer count on the bomb killing a CT who saves behind cover.

2026 Dust2 results among these teams

Stealing it for your own team

Pick one pistol per CT tendency you expect, rehearse it until the timings are automatic, and spend your $800s on utility before armour.

1. Name your donk. Decide who wins the duel and make two teammates flash for him. This is Spirit’s whole 2026 upgrade, and it works at every level.
2. Name your Aleksib. Someone dies first on purpose. Agree who, and agree who trades — the trade is what NAVI lost at Cologne.
3. Keep one lurker alive. A ropz-style player in lower tunnels or mid on pistol catches the early rotator and turns a 4v5 into a won round.
4. Have a B and an A version. Fast B through upper tunnels for opponents who play 2–1–2; mid-to-B or short A for anyone who stacks B.
5. Buy utility, not five kevlars. A smoke for CT or window and two flashes for the entry win more pistols than armour on the riflers.
6. Plan round 2 before round 1. Ts convert a pistol win into round 2 about 81% of the time on Dust2. Know your anti-eco positions: hold long and B doors, do not chase into SMG range.
7. Respect the new bomb. Since July, a CT who saves behind a wall survives the explosion. Hunt the saver if the round 2 economy matters.

Back in 2018-19 I spent a stretch of nights in a parking lot with a laptop, a little orange radio board, and a car key. By the end of it I could unlock cars I had permission to test without ever touching their keys. I wrote it up as a paper, Cyber Attacks on Smart Cars using SDR, published in IRJET (Volume 6, Issue 12, Dec 2019). This post is the human version of that paper, plus the hands-on work that lives in my Car-Hacking repo.

A quick, important note before anything else: this was controlled research on vehicles I was allowed to test, done to show a real weakness so it can be fixed. Don’t do this to cars you don’t own. It’s illegal, and that’s not the point.

How keyless entry actually works

The old way to unlock a car was boring and safe: a metal key in a metal lock. Keyless fobs traded that for convenience. Press the button and the fob transmits a short burst of radio at a specific frequency. If the car hears a burst it recognizes, the doors unlock.

In my testing that frequency sat around 433.9 MHz, a common band for key fobs. And here’s the catch that makes the whole attack possible: on the cars I looked at, the fob sent essentially the same code every time. If the code never changes, then anything that can record radio and play it back can impersonate the key.

The whole attack fits in one picture: record the owner’s press, then play it back later.

The gear: SDR, GNU Radio, and a HackRF

Software-Defined Radio (SDR) is the idea that a radio can be defined in software instead of fixed hardware. Instead of a circuit built to do one thing, you get a general-purpose radio and write the logic.

I used two pieces:

• GNU Radio Companion, a visual toolkit where you wire up “blocks” into a flowgraph to process radio signals.
• A HackRF from Great Scott Gadgets, the actual radio hardware that listens and transmits, connected to the laptop over USB.

Together they let me treat a car key’s signal like any other data: capture it, look at it, and send it back.

Step one: capturing the key

The capture flowgraph was simple. The important blocks:

Osmocom Source   ->  switches the HackRF into receive mode over USB
  center freq:   ~433.9 MHz   (the key fob band)
  sample rate:   2 MHz
QT GUI Waterfall Sink  ->  live visual of the spectrum
File Sink        ->  writes the captured signal to disk

The Osmocom Source is the abstraction layer that talks to the HackRF and tells it to start receiving. The Waterfall Sink draws the spectrum in real time, so when I pressed the fob button, a bright peak jumped up at the key’s frequency. That peak is the key’s transmission. The file sink saved the raw signal so I could replay it later.

Step two: replaying it at the car

Replay is capture in reverse. The flowgraph reads the saved signal back from the file and pushes it out through the HackRF, with a Throttle block to emit it at a steady, repeated rate so it cleanly matches the frequency the car expects.

File Source  ->  Throttle  ->  Osmocom Sink (HackRF, transmit)

Point the radio at the car, run the graph, and the recorded “unlock” plays back on the air. The car hears a code it trusts and opens. That’s a replay attack: no cloning, no cracking, just record and re-send. The same approach extends to man-in-the-middle (sitting between fob and car) and, with enough noise on the band, denial of service by jamming the fob so the real key stops working.

Which cars fell to it

The formal results in the paper were on three cars, with the Indian Honda City i-Vtec as the main test subject, plus the Toyota Innova Crysta and the Maruti Wagon R. On all three, capture-and-replay worked.

I also ran the same attack against a 2014 Hyundai Xcent. The capture and replay flowgraphs for it (xcentcap.grc and xcentreplay.grc) are in the repo alongside the Honda and Wagon R graphs. Same method, same result.

Why it worked, and the fix

None of this is clever cryptography on my end. It worked because the fobs used fixed codes. A code that never changes can always be replayed.

The fix has existed for decades, and good cars already use it:

• Rolling codes (hopping codes). The fob and car share a cryptographically secure sequence. Every button press sends the next code, and the car accepts only codes ahead of the last one it saw (typically within a window of about 256, in case a few presses happen out of range). A replayed old code is simply rejected.
• KeeLoq. A classic code-hopping cipher: it encrypts a 32-bit block to produce a 32-bit hopping code (with a 32-bit initialization vector XORed in), combined with a fixed serial-number portion. Every press produces a different transmission, so a recording is useless a moment later.

The threat model is worth stating plainly. An attacker who owns the fob’s radio link can unlock, steal, track, lock out a key, try to brute-force or clone the fob, or jam its signal. Rolling codes shut down the easy end of that list. My conclusion in the paper was blunt: every car should at least implement a rolling-code mechanism. In 2019 some still didn’t.

Takeaways

The lesson that stuck with me: convenience features quietly become attack surface. A key fob feels like a small thing, but it’s a radio protocol, and radio protocols need the same rigor as anything else. A fixed code is a password you broadcast to everyone nearby.

If you want the formal details, read the full paper. If you want the actual GNU Radio flowgraphs and code, they’re in the Car-Hacking repo. Questions or corrections, find me on X.

Here’s what I plan to write about.

Exploit development notes

I’m learning exploit development, and I’ll post notes as I go: concepts that finally clicked, labs and CTF challenges I work through, and breakdowns of publicly disclosed vulnerabilities. Expect mistakes along the way. Those are part of the point.

How my AI bot stack works

I’m building a team of AI bots, each with its own job, that work together to help me run things. I’ll write about how they’re set up, how they hand work to each other, and what breaks.

Counter-Strike 2

I play CS2, so expect the occasional take, clip, or thing I learned from grinding.

Project writeups

I also want to go back and properly write up older projects. The first one on the list is my Car-Hacking repo, which uses software-defined radio (a HackRF) and Python to capture car key fob signals and explore replay, man-in-the-middle, and denial-of-service attacks.

# Rough idea of what's coming in that writeup
steps = ["capture the key fob signal", "analyze it", "replay it", "understand why it worked"]
for step in steps:
    print(f"[+] {step}")

If any of this sounds interesting, follow me on X or check out my GitHub. More soon.