Nam Le Phuong

Nam Le has over 13 years of experience in cybersecurity. He currently serves as a Senior Digital Forensics and Incident Response (DFIR) Specialist at Group-IB, where he focuses on investigating sophisticated cyber threats and helping organizations respond to and recover from complex security incidents.

Throughout his career, Nam has led numerous investigations into advanced threat actors, ransomware campaigns, and post-compromise activity targeting critical infrastructure and enterprise environments. His technical research has been published in several in-depth blogs, including analyses of the RansomHub ransomware group, TeamTNT’s operations in cloud-native environments, abuse of Linux Pluggable Authentication Modules (PAM), and stealth techniques involving Linux /proc manipulation.

Nam is a recognized contributor to the MITRE ATT&CK® framework, specifically for Technique T1564.013 (https://attack.mitre.org/techniques/T1564/013/), where he provided insight into evasion tactics involving hidden or obfuscated files and directories. He also holds the GIAC Network Forensic Analyst (GNFA) certification and actively participates in DFIR conferences, sharing field experience and advanced investigation techniques with the broader security community.

In addition to his technical work, Nam has helped build and strengthen customer and partner ecosystems by developing hands-on training and enablement programs. His expertise spans a wide range of areas including digital forensics, virtualization, computer investigations, privileged activity monitoring, anti-fraud, and secure infrastructure design.