After the first shock from Wannacry's global attack, the authorities began hunting for those behind the biggest ransomware attack ever.
"We are searching through huge amounts of data associated with attack to identify patterns", said Lynne Owens, general manager of the National Crime Agency, the British anti-organized crime group.
The National Crime Agency works alongside international law enforcement partners, including Europol, Interpol and the FBI, to investigate the attacks.
"We are actively exchanging information about this event and are ready to provide technical support and assistance as needed to our partners in the United States and internationally."
But the "surprise" in WannaCry's story came from a Google researcher who wants the ransomware writers to be from North Korea.
Earlier today, Google Neel Mehta researcher published a Twitter message containing the hashtag #WannaCryptAttribution.
9c7c7149387a1c79679a87dd1ba755bc @ 0x402560, 0x40F598
ac21c8ad899727137c4b94458d7aa8d8 @ 0x10004ba0, 0x10012AA4#WannaCryptAttribution- Neel Mehta (@neelmehta) May 15, 2017
The message contains compare samples from the sample encryptions of WannaCry from February 2017 and a sample of the group Lazarus APT from February of 2015, as people point out to Kaspersky Lab. The commands presented in the tweet represent a unique coding algorithm.
The Lazarus team is a well known hacker group. They have been linked to the Sony Wiper attack, as well as to the tragedy of the Bangladeshi banks that left them a few million poorer. The team has been active since 2011 and hundreds of samples of code have been collected. It was revealed that they were creating malware, developing new samples through "multiple freelancers".
There are, of course, many questions about the "appearance" of the Lazarus team at the moment. Is it true or is it just someone who imitates them?
Besides, it is not so difficult for WannaCry authors to copy the code used by Lazarus team. Moreover, today's situation with the US concentrating its fleet around North Korea allows for many confessional correlations ...
On the other hand, the code does not appear to have been removed from its code backdoor cuts of 2015, which makes the story much more believable.
Kaspersky's investigators are said to be quite certain that the WannaCry sample released in February 2017 was compiled by the same people behind the current attack or by people who have access in the same source code.
Other security researchers, besides Mehta, have noticed the same similarity as Matthew Suiche of Comae Technologies, who discovered and stopped a new variant of malware by activating a different kill switch.
https://twitter.com/msuiche/status/864179805402607623
Now, interest will be if Lazarus team also recognized by the US intelligence services. Kaspersky Lab itself reported some details just about a month ago, linking attacks to Vietnamese banks, Bangladesh bank, SWIFT banking system, Lazarus and North Korea.
