The Federal Bureau of Investigation (FBI), the U.S. Department of State, and the National Security Agency (NSA) are jointly issuing this advisory to highlight attempts by Democratic People’s Republic of Korea (DPRK, a.k.a. North Korea) Kimsuky cyber actors to exploit improperly configured DNS Domain-based Message Authentication, Reporting and Conformance (DMARC) record policies to conceal social engineering attempts. Without properly configured DMARC policies, malicious cyber actors are able to send spoofed emails as if they came from a legitimate domain’s email exchange. The North Korean cyber actors have conducted spearphishing campaigns posing as legitimate journalists, academics, or other experts in East Asian affairs with credible links to North Korean policy circles. North Korea leverages these spearphishing campaigns to collect intelligence on geopolitical events, adversary foreign policy strategies, and any information affecting North Korean interests by gaining illicit access to targets’ private documents, research, and communications. This Joint Cybersecurity Advisory (CSA) includes indicators of North Korean social engineering (page 4) for potential victims receiving spearphishing emails as well as mitigation measures (page 9 of linked report) for organizations who could be victims of North Korean impersonation.
For additional information on state-sponsored North Korean malicious cyber activity, see the June 2023 Kimsuky CSA, “North Korea using Social Engineering to Enable Hacking of Think Tanks, Academia, and Media.” https://media.defense.gov/2023/Jun/01/2003234055/-1/-1/0/JOINT_CSA_DPRK_SOCIAL_ENGINEERING.PDF
Link to full report: tlp-clear-cybersecurity-advisory-north-korean-actors-exploit-weak-dmarc-security-policies-to-mask-spearphishing-efforts.pdf
Comments