Cybersecurity firm Symantec says the world’s biggest cyberattack shows strong links to Lazarus, a hacking group that has previously been tied to North Korea.
The global ransomware attack known as WannaCry targeted hundreds of thousands of computers in around 150 countries, hitting hospitals, businesses and other organizations.
In a blog post late Monday, security researchers at Symantec said the “tools and infrastructure used in the WannaCry ransomware attacks have strong links to Lazarus, ” a hacking group that has previously been tied to North Korea.
“We have high probability that these two are absolutely connected, ” said Vikram Thakur, Symantec’s security response technical director.
Lazarus has been linked to the hack on Sony Pictures, for which the U. S. government blamed North Korea, and a wave of attacks on banks around the world, including a major theft from Bangladesh’s central bank.
Related: North Korea’s long history of hacking
Security researchers started to suggest possible links between WannaCry and Lazarus just days after the attack. Now, those connections are becoming clearer.
Cybersecurity company FireEye was cautious at first, but one of its analysts, Ben Read, said Tuesday he has also found WannaCry shares unique code with “malware that we have previously attributed to suspected North Korean actors.
