A good explainer from Kaspersky: <a href="https://securelist.com/blog/research/78431/wannacry-and-lazarus-group-the-missing-link/" rel="nofollow">https://securelist.com/blog/research/78431/wannacry-and-laza...</a>