WannaCry ransomware attacks show strong links to Lazarus, the hacking group that was linked to Sony Pictures and Bangladesh central bank hacks
Similarities in code and infrastructure indicate close connection to group that was linked to Sony Pictures and Bangladesh Bank attacks.
Context & Ripple Effects
Symantec's code-and-infrastructure comparison is the third time the same fingerprint has surfaced. The SMB worm tool used against Sony Pictures in 2014 was the first marker, and during the SWIFT breach investigation that spread to 12 more banks Symantec had already corroborated BAE's finding that the attackers reused code similar to the North Korean Sony malware.
If the linkage holds up as it did for the bank heists — weeks later the NSA and Britain's National Cyber Security Centre made the same WannaCry-to-Lazarus call — WannaCry stops being an ordinary extortion campaign and becomes a nation-state operation that hit hundreds of thousands of machines.
First-order effects
- Organizations still cleaning up WannaCry infections now face a different adversary profile: a group Kaspersky had already tied to the Sony hack, military espionage, and attacks on Korean banks, not a typical criminal crew.
- Other security vendors are pushed to publish their own code analysis quickly, either corroborating or contesting Symantec's attribution claim.
Second-order effects
- Banks and SWIFT members — the sector already burned when the same group's tooling appeared in the Bangladesh Bank heist — must now treat ransomware defense as counterintelligence, hardening against state-grade worm tooling rather than commodity extortion.
- Governments gain a concrete basis for diplomatic and sanctions responses against North Korea, since the same code trail connects a mass civilian-impact attack to previously attributed state operations.
Third-order effects
- One group now spans espionage (Sony), financial theft (SWIFT/Bangladesh Bank), and indiscriminate global ransomware — eroding the line between state intelligence work and criminal monetization, and forcing defenders to plan for adversaries who do both.
- Attribution-by-shared-code, proven across the Sony, SWIFT, and now WannaCry cases, is consolidating into the standard method vendors and agencies use to pin attacks on state actors.
The trend: State-linked hacking groups are collapsing the boundary between espionage, bank robbery, and mass ransomware, with overlapping code trails becoming the primary basis for public attribution.