The U.S. Government, through a collaborative effort between the NSA, FBI, and State Department, has issued a warning about an ongoing cyber espionage campaign orchestrated by the APT43 North Korean-linked threat actors, also known as Kimsuky or Emerald Sleet. APT43, having been around since at least 2012, has links to North Korea’s main military intelligence organization, the US-sanctioned Reconnaissance General Bureau (RGB), and is more properly known for their intelligence collections and espionage activities. The APT43 campaign has been ongoing since the end of 2023, and seeks to exploit vulnerabilities in email security systems, specifically targeting the Domain-based Message Authentication, Reporting, and Conformance (DMARC) policies. By manipulating these security weaknesses, the attackers can send spear-phishing emails that appear to originate from legitimate and trusted sources, giving them the ability to pose as journalists, academics, or other experts in East Asian affairs. Their focus is gathering intelligence related to geopolitical events, foreign policy strategies, and other areas of interest to the Democratic People’s Republic of Korea (DPRK). The group employs sophisticated social engineering and impersonation tactics to build trust with their targets over time, as part of a broader strategy to collect sensitive information without necessarily resorting to malware or credential harvesting, often by soliciting opinions or analyses directly from the targets. The campaign’s success is partly due to the exploitation of entities that have either not enabled or improperly configured their DMARC policies, allowing these phishing emails to bypass traditional security checks. Per the advisory, CTIX analysts advise organizations to update their DMARC policies so that their email servers quarantine or block emails that fail DMARC checks, especially US or South Korean entities with individuals working on matters related to North Korea, Asia, China, or Southeast Asia, and more specifically individuals who are government officials and military members.