Suspects Lazarus and North Korea?

Wannacry and Lazarus Group - the missing link? - Securelist

Lazarus Under The Hood (Blogpost) - Securelist