Ha Thi Thu Nguyen

CERT-GIB Analyst Tier-2, APAC

Ha Thi Thu Nguyen began her career in 2021 at Group-IB as an Analyst with the Digital Risk Protection (DRP) team, focusing on the APAC region, particularly Vietnam. With extensive experience in her field, she now leads a segment of the Asia-Pacific team, and mentors junior analysts. Her expertise includes safeguarding digital assets against online threats, such as phishing, scams, counterfeiting, data leaks, implementing effective takedown strategies to safeguard clients’ digital assets, and brand reputation.

Awards and recognitions

GIB Star Achievement coin

GIB STAR challenge coin – For significant achievements, large-scale projects, and developing new lines of business throughout the year

Blog posts by Ha Thi Thu Nguyen

Gold factory
Malware Analysis
December 3, 2025
Hook for Gold: Inside GoldFactory’s Сampaign That Turns Apps Into Goldmines
A deep dive into GoldFactory’s evolving mobile fraud campaigns across APAC, including modified banking apps, new malware variants such as Gigaflower, shared criminal infrastructure, and insights from the Group-IB Fraud Matrix, with recommendations for organizations and end users.
Scam & Phishing
April 23, 2025
Toll of Deception: Where Evasion Drives Phishing Forward
Discover the latest phishing campaign targeting a major toll road service provider, where cybercriminals use sophisticated evasion techniques to bypass security detections. This in-depth blog reveals how threat actors exploit legitimate platforms and deploy cloaking methods to disguise malicious links, allowing them to evade detection by security solutions. Discover how these sophisticated tactics create highly convincing phishing pages designed to steal victims’ card information, and how to safeguard yourself against these evolving cyber threats.
Trust Hijacked
Scam & Phishing
December 11, 2024
Trust Hijacked: The Subtle Art of Phishing Through Familiar Facades
Explore the advanced tactics employed in recent email phishing campaigns targeting employees from over 30 companies across 12 industries and 15 jurisdictions. This blog unveils sophisticated techniques used to outsmart Secure Email Gateways (SEGs) and exploit trusted platforms, creating highly convincing schemes to deceive victims and steal their credentials.