2/12/21

LP, AP & IT Security's #1 News Source

Russia Taking Total Control Over the Dark Web?
Will Russian Cryptocurrency Law Drive Hacker Recruitment?

Regulation Requires Russians to Disclose Their Cryptocurrency Transactions - Or Else

Did Russia pass a tough new cryptocurrency law to help authorities recruit or compel criminal hackers to assist the government?

That's the thesis of a new report from New York-based threat intelligence firm Advanced Intelligence, aka AdvIntel. While a new law in Russia that took effect on Jan. 1 provides a legal framework for using cryptocurrency, it also includes a host of provisions designed to unmask users of bitcoins, monero and other virtual currencies, the report notes.

"By enforcing the cryptocurrency law, the Russian government builds the legal base for overtaking the power and establishing total control over the dark web market, including the ransomware sector."

"The new Russian crypto law requires all cryptocurrency holders, including individuals, companies and Russian authorities, to report their crypto transactions and wallet balances if the transaction amounts exceed 600,000 rubles - approximately $8,124 - in a calendar year," Anastasia Sentsova, an analyst at AdvIntel, and Yelisey Boguslavskiy, the firm's CEO, write in the report. "Failing to report twice in three years or providing inaccurate information will result in monetary fines, forced labor and imprisonment."

Ostensibly, the law is designed "to prevent illegal cryptocurrency transactions and money laundering," the AdvIntel researchers say. But in reality, the move might be an attempt "to monopolize the dark web market, including the ransomware sector, by excluding competitors who interfere with government plans and take away the profit," they say. It also could be part of an attempt to "recruit new hackers" to assist government offensive hacking teams.

Russian President Vladimir Putin last August signed into law the bill, which legalizes cryptocurrency, albeit with a host of caveats.  govinfosecurity.com

Virginia is poised to pass a state privacy law
Virginia is poised to pass a privacy law - highlighting how a patchwork of rules is emerging across the country in the absence of federal action by Congress.

The legislation allows residents of the commonwealth to opt out of targeting their data and the sale of their data, similar to California's law. They could also obtain the data that companies have collected about them, and correct or delete it.

The bill was passed by the state's House of Delegates and Senate, and it's expected to move to the governor's desk as early as this month after a reconciliation process. Known as the Virginia Consumer Protection Act, the legislation would take effect in 2023. Amazon, Microsoft and tech industry trade groups have backed the bill.

Virginia Delegate Cliff Hayes Jr., who introduced the House bill, said the proposal was influenced by Europe's General Data Protection Regulation and other state privacy efforts - and that Virginians need these protections in the absence of action in Washington.

The action at the state level could put more pressure on industry groups to work with national lawmakers to advance privacy legislation to ensure they don't have to deal with the headaches of complying with different laws in each state.

Washington state is resuming debate on its own proposal. Minnesota, New York, Oklahoma and others are also weighing proposals. washingtonpost.com

Ransomware Attackers Set Their Sights on SaaS

Ransomware has begun to target data-heavy SaaS applications, open source, and Web and application frameworks.

Ransomware attacks have begun to more heavily target software applications, open source tools, and Web and application frameworks as attackers seek more direct paths to organizations' largest and most important data stores.

How They're Breaking In
Attackers are also looking for more severe vulnerabilities to reach these targets - namely, those that are capable of remote code execution (RCE) or privilege escalation (PE) when exploited.

Between 2018 and 2020, more than 25% of CVEs used in ransomware attacks were considered "dangerous," meaning they were capable of RCE or PE and had weaponized exploits. While the number of weaponized vulnerabilities went down overall, the number of RCE/PE flaws increased. Researchers report more than 25% of newly published CVEs pose a higher risk to organizations due to these RCE/PE capabilities.

The Ransomware Family Tree Grows
Researchers identified 125 ransomware families using 223 CVEs. Some of the more prominent families include Crypwall, which uses 66 CVEs, Locky (64), Cerber (62), Cryptesla (56), GandCrab (51), Cryptomix (50), Reveton (46), and Waltrix (45). Of the ransomware families detected, 42 only use vulnerabilities reported in 2019 or earlier, with the oldest flaw reported in 2010.

The number of ransomware families has continued to grow as new players enter the scene, joining old groups that continue to operate. Some, such as Cobralocker and Lokibot, have been running since 2012 and don't show any signs of retiring, researchers note. darkreading.com

JUST RELEASED: NIST's Key Practices in Cyber Supply Chain Risk Management
NIST announces the release of NISTIR 8276, Key Practices in Cyber Supply Chain Risk Management (C-SCRM): Observations from Industry. This final document provides the ever-increasing community of digital businesses a set of Key Practices that any organization can use to manage cybersecurity risks associated with their supply chains.

The Key Practices presented in this document can be used to implement a robust C-SCRM function at an organization of any size, scope, or complexity. These practices combine the information contained in existing C-SCRM government and industry resources with the information gathered during the 2015 and 2019 NIST research on industry best practices. The Key Practices also include 24 actionable recommendations that synthesize how these practices can be implemented from a people, process, and technology perspective. govdelivery.com

How Your Boss Can Use Your Remote-Work Tools to Spy on You

Columbus, OH: C-Store Owner shot and killed over an argument inside the store
Police said a warrant charging Mark Stephens, 41, with murder in the death of Jimmy Crum, 51, has been filed. On Tuesday, Feb. 9, police were called to Van's Carry Out at 1270 W. Town St. on a report of a shooting. According to police, there was a dispute inside the store during which a customer was thrown out of the store by Crum and another employee. As he was leaving, the customer made threats to come back and shoot the employees. abc6onyourside.com

Williamsport, PA: Man shot, killed by Police after Armed C-Store Robbery, chase
Authorities on Friday launched an investigation after police in Pennsylvania shot and killed a man who they were pursuing following an armed robbery had brandished a weapon at them, officials said. The events unfolded Thursday night when state troopers responded to a domestic dispute in which a handgun was used to assault a victim at a trailer park in Woodward Township, state police said. According to officials, Clifford Wilbur Jr., 38, had fled the scene and then robbed a convenience store at gunpoint. Police gave chase and Wilbur's vehicle crashed. Wilbur produced a handgun and troopers and officers opened fire, state police said. Wilbur was pronounced dead by the county coroner. miamiherald.com

Columbus, GA: Man shot and killed at restaurant early Friday morning
Columbus police are investigating an overnight shooting that left one person dead. Muscogee County Coroner Charles Newton tells News 3 the victim was shot and killed at the Suite Bar & Grill on Sydney Simon Blvd early Friday morning. The victim was pronounced dead at 2:43 a.m., Newton said. wrbl.com

Jurupa Valley, CA: Body camera footage released in death of Ernie Serrano at Stater Bros
Body camera footage of sheriff's deputies arresting Ernie Teddy Serrano, a Jurupa Valley man who died while restrained inside a Rubidoux Stater Bros. market, was released Thursday, further illustrating that deputies were familiar with Serrano from a previous arrest. The two videos show deputies struggling with Serrano after they tasered him, and then pinned him facedown onto a grocery store counter for about six minutes until deputies noticed that he had stopped breathing. The newly-released videos largely confirm the Riverside County Sheriff's Department's telling of events. Conversation heard in the video also provides details and context about Serrano's alleged drug use and his actions leading up to the arrest. pe.com

Baltimore, MD: Police Release Body Cam Video Of Officer-Involved Shooting Inside Grocery Store
The Baltimore Police Department Thursday released body-worn camera footage from two officers involved in a shootout with an armed grocery store security guard late last month. The video shows the moments Ofcs. Wesley Rosenberger and Daniel Jensen pulled up to the Compare Foods in the 5600 block of The Alameda on January 30 after getting a call about an armed person. After the officers walked into the store, the security guard, Dontae Green, reportedly pulled out a 9mm semi-automatic handgun and began shooting. Ofc. Jensen ran to the front of the store while Ofc. Rosenberger ran up a flight of stairs into what appeared to be an office. Rosenberger and Green exchanged gunfire. Green was able to get away through a back door but was fatally shot days later as a U.S. Marshals task force tried to arrest him. baltimore.cbslocal.com

Robberies, Incidents & Thefts

Maryville, TN: Man charged with attempted robbery, public intoxication after Food City incident
An incident report states an officer at approximately 10:20 p.m. arrived at Food City on a call of a disturbance involving an impaired man. "While speaking with Mr. Holtcamp, I observed him to have slurred speech, smelled of alcoholic beverages, and was very unsteady (on) his feet," the officer wrote in the report. "Mr. Holtcamp stated that he had been drinking alcohol, along with his medication, prior to this incident." The officer spoke with a Food City employee, who said she was placing money from the registers into a safe when Holtcamp walked behind her, held his hands in the shape of pistols and said, "Give me all of your money," the report states. The employee didn't comply with the demand, and Holtcamp left the store. The employee told the officer she feared for her safety during the incident, and officers confirmed her story via store security camera footage, the report states. thedailytimes.com

Burlington County, NJ: HR Manager charged with theft of over $600,000
Burlington County Prosecutor announced that a 41-year-old Maple Shade woman has been charged with stealing more than $600,000 from her Cinnaminson-based employer, SEA BOX, Inc., over a one-year period ending in December 2020. The investigation began after SEA BOX officials informed the Cinnaminson Township Police late last year that O'Brien had been caught embezzling funds. The investigation revealed that over a 12-month period, O'Brien, who served as human resources manager, had used the company's credit card for personal expenses totaling $614,499. The investigation further revealed that O'Brien made several purchases of designer clothes, handbags, and other accessories from luxury stores such as Saks Fifth Avenue, Gucci, and Louis Vuitton, among others. She also used the company credit card to purchase airfare, rental cars and lodging accommodations for her and others to vacation in Puerto Rico, and even used it to pay for herself and a friend to undergo buttock augmentation procedures.  southjerseylocalnews.com

New York, NY: Man stabbed during wild fight in Midtown Manhattan 7-Eleven

Albuquerque, NM: Man pleads guilty to Federal Armed Robbery of medical products and drug charges

Evesham Township, NJ: : Man, 22, arrested in $77,000 high-end jewelry store theft

New Castle, PA: police arrest suspect in CVS Pharmacy Armed Robbery

King Sooper Shopper slaps employee for asking her to wear face mask

Submit Your New Hires/Promotions or New Position

Featured Job Spotlights
 

	Regional Manager LP, Audit & Firearms Compliance IL, WI, MN, IA, ND, SD, NE, OK, MO & KS - posted Feb. 12 The Regional Loss Prevention Manager is responsible for the control and reduction of shrinkage at the stores in their Territory. Investigate and resolves all matters that jeopardize or cause a loss to the company's assets...
	Regional LP & Safety Manager Denver, CO - posted Feb. 9 The Regional Loss Prevention & Safety Manager implements Risk Management and Loss Prevention objectives within assigned region. The position will provide assistance and training to the field operations teams to address specific Risk Management and Loss Prevention issues within an assigned span of control.  Read job description here
	Manager of Asset Protection & Safety Operations Rockaway, NJ - posted Feb. 4 The Manager of Asset Protection & Safety Operations is responsible for the control and reduction of shrinkage and safety compliance for Party City Holdings, by successfully managing Asset Protection (AP) Safety programs and reporting...
	Loss Prevention Auditor and Fraud Detection Analyst Raleigh, NC - posted Dec. 14 As a Loss Prevention Auditor and Fraud Detection Analyst for Staples, you will conduct LP operational field audits remote, virtual and in person, within a base of 60 retail stores to ensure compliance to operational standards to drive operational excellence and preserve profitability...
	Leader, Asset & Profit Protection San Fran/Chicago/NY/West Palm Beach - posted Dec. 14 As the leader of the Data/Analytics & Investigations strategy, you should have strong analytical/investigation skills, the drive to innovate, and the ability to build strong partnerships to lead through the influence of others. They will be personable, open to learning, collaborating with others...
	Customer Success Specialists Multiple Locations - posted Oct. 9 The role of the Customer Success Specialist is to engage, empower, and excite our community. As a Customer Success Specialist, your primary responsibility is to ensure both retailers and law enforcement, who make up our community, have great experiences and achieve real crime reduction outcomes from using our platform. Apply Here
	Sales Representatives NuTech National - posted Oct. 13 NuTech National, an established and rapidly growing 40+ year electronic security company is expanding our National Sales Team. Seeking motivated, driven and successful sales reps to expand our national retail and governmental vertical markets. Top pay, benefits and signing bonus available. Please apply to melissa@nutechnational.com

Latest Top Jobs
	Vice President, Loss Prevention San Francisco, CA The Vice President of Loss Prevention reports to the Company's General Counsel and is responsible for leading the organization's global asset protection and security efforts. You will collaborate effectively across the Company.  linkedin.com
	Executive Director, Asset Protection Rosemead, CA The Executive Director, AP is responsible for the company's AP function, protecting the company's integrity, people, processes, and assets from harm and loss. This position serves as the subject matter expert on a broad range of security standards and disciplines.  pandarg.referrals.selectminds.com
	Senior Director, Loss Prevention Calabasas, CA The Senior Director of Loss Prevention is responsible for setting and championing the Loss Prevention strategy for the enterprise, including retail stores, distribution centers, corporate offices and quality assurance labs.  sjobs.brassring.com
	Director, Asset Protection Solutions Deerfield, IL Responsible for developing and implementing department strategies and integrating efforts with division and company strategies, emphasizing product availability, inventory productivity, and cost productivity.  jobs.walgreens.com
	Senior Manager, Asset Protection Atlanta, GA The Sr Manager Asset Protection is responsible for ensuring that Asset Protection programs are fully implemented and are being executed per expectations within assigned distribution centers.  careers.homedepot.com
	BJ's Wholesale Regional AP Rollout - 8 New Positions The Regional AP Manager oversees AP, security, theft, fraud, investigations, and related procedures within the field. The RAPM supports and continuously interacts with club management to analyze shrink, identify profitability gaps and address issues related to protecting company assets. See all the job listings

Featured Jobs

To apply to any of today's Featured Jobs, Click Here

View Featured Jobs   |   Post Your Job
 

We want to post your tips or advice... Click here

Not getting the Daily? Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here

FEEDBACK    /    downing-downing.com    /    Advertise with The D&D Daily