Exploit Weak DMARC.pdf

The FBI, U.S. Department of State, and NSA jointly warn that North Korean Kimsuky actors are exploiting weak or absent DMARC policies to spoof trusted domains and conduct targeted spearphishing against think tanks, academia, media, and government experts; the advisory includes real sample emails and headers, red-flag indicators, recommended mitigations (set DMARC to p=quarantine or p=reject, configure rua reports), and reporting instructions.