NSA warns of North Korean hackers exploiting weak DMARC email policies

On May 2, 2024, the FBI, the U.S. Department of State and the National Security Agency (NSA) published a joint cybersecurity advisory titled North Korean Actors Exploit Weak DMARC Security Policies to Mask Spearphishing Efforts.

What the advisory says

• A North Korean group the agencies call Kimsuky runs spearphishing campaigns "posing as legitimate journalists, academics, or other experts in East Asian affairs".
• DMARC is what makes it work: "Without properly configured DMARC policies, malicious cyber actors are able to send spoofed emails as if they came from a legitimate domain's email exchange."
• The weak spot is a domain with no DMARC policy, or with one left at p=none. In the agencies' words, those "indicate that the receiving email server should take no security action on emails that fail DMARC checks and allow the emails to be sent through to the recipient's inbox."

What the agencies recommend

Update the domain's DMARC policy to p=quarantine or p=reject, and set the rua field to receive aggregate reports about the mail sent in the domain's name.

⚠️ Do not paste p=reject into your DNS today if your domain has never had DMARC. Start at p=none with a rua address, read the reports until every tool that legitimately sends as you (newsletter, invoicing, CRM) passes, then move to p=quarantine and to p=reject. p=none is where you start, not where you stay — see p=none: the DMARC policy that looks compliant and stops nothing.

Why it matters outside think tanks

Nothing in this technique is specific to North Korea or to policy experts. A domain with no DMARC policy, or one parked at p=none, gives the same opening to anyone who wants to send email in its name.

Check your domain now →

Sources

• The joint advisory (PDF, FBI / State / NSA): https://www.ic3.gov/Media/News/2024/240502.pdf
• NSA press release: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3762915/nsa-highlights-mitigations-against-north-korean-actor-email-policy-exploitation/
• BleepingComputer coverage: https://www.bleepingcomputer.com/news/security/nsa-warns-of-north-korean-hackers-exploiting-weak-dmarc-email-policies/