After the first shock from Wannacry's global attack, the authorities began hunting for those behind the biggest ransomware attack ever.
"We are searching through huge amounts of data associated with attack to identify patterns", said Lynne Owens, general manager of the National Crime Agency, the British anti-organized crime group.
"We are actively exchanging information about this event and are ready to provide technical support and assistance as needed to our partners in the United States and internationally."
But the "surprise" in WannaCry's story came from a Google researcher who wants the ransomware writers to be from North Korea.
Earlier today, Google Neel Mehta researcher published a Twitter message containing the hashtag #WannaCryptAttribution.
The message contains compares samples from the WannaCry crypt sample from February of 2017 and a sample of the group Lazarus APT from February of 2015, as people point out to Kaspersky Lab. The commands presented in the tweet represent a unique coding algorithm.
The Lazarus team is a well known hacker group. They have been linked to the Sony Wiper attack, as well as to the tragedy of the Bangladeshi banks that left them a few million poorer. The team has been active since 2011 and hundreds of samples of code have been collected. It was revealed that they were creating malware, developing new samples through "multiple freelancers".
There are, of course, many questions about the "appearance" of the Lazarus team at the moment. Is it true or is it just someone who imitates them?
Besides, it is not so difficult for WannaCry authors to copy the code used by Lazarus team. Moreover, today's situation with the US concentrating its fleet around North Korea allows for many confessional correlations ...
On the other hand, the code seems to have not been removed from 2015's backdoor code, which makes history much more reliable.
Kaspersky researchers are pretty sure that WannaCry's sample released in February of 2017 was compiled by the same people who are behind the current attack or by people who have access to the same source code.
Other security researchers, besides Mehta, have noticed the same similarity as Matthew Suiche of Comae Technologies, who discovered and stopped a new variant of malware by activating a different kill switch.
- Matt “Swish” Suiche (@msuiche) May 15, 2017
Now, interest will be if Lazarus team also recognized by the US intelligence services. Kaspersky Lab itself reported some details just about a month ago, linking attacks to Vietnamese banks, Bangladesh bank, SWIFT banking system, Lazarus and North Korea.