I Went to BSides Calgary 2026
I recently attended BSides in Calgary, Alberta, Canada, which took place from May 25th to May 26th. This was the 10th year of the BSides conference in Calgary, and it was also my second time attending BSides Calgary.
If you’ve never heard of BSides, it is a community-driven cybersecurity conference made by the community, for the community. Each local chapter creates and runs its own BSides conference.
In this post, I will detail my experience at BSides Calgary 2026.
In previous years, BSides Calgary was held at Bow Valley College. This year, the conference was hosted at Contemporary Calgary.
Contemporary Calgary is a really cool venue because it used to be the Centennial Planetarium, which was also the TELUS World of Science. I remember visiting it when it was the TELUS World of Science. It was really cool to see that space again.
Day 1
The day started with registering and picking up my badge.
After registering, it was time for the keynote, hosted by Terry Ingoldsby. In the keynote, Terry spoke about the history of the internet in Calgary. It was really cool to learn that the University of Calgary had access to the DARPA (Defense Advanced Research Projects Agency) version of the internet (at the time, the only version of the internet). Around the same time, Unix was growing in popularity, and CUUG (Calgary Unix User Group) was formed. Eventually, they got a connection from the University of Calgary, making CUUG the second place in Calgary to have internet. One of the things I took away from the keynote is that you shouldn’t look at cybersecurity as just good vs. evil, you should treat it as an engineering problem to solve instead, and just because you are secure doesn’t make you compliant, and just because you are compliant doesn’t make you secure.
The next session I attended was LLM-Assisted Malware Development: Case Study and Defensive Strategies, which was hosted by Kai Iyer. In the session, Kai dissected how the LameHug infostealer malware works. LameHug is really interesting because it is the first known malware to directly integrate AI into its workflow. At its core, it uses the LLM model Qwen 2.5-Coder-32B-Instruct, which Hugging Face hosts. The prompt LameHug sends to Qwen is very innocent, as it simply asks to gather basic system information and place it in a text file, which is no different from what a system administrator would do. Because of the innocent request, Qwen complies and doesn’t flag the prompt as malware.