[zmmz]

There's an article on it in NYT which provides a short list of the reaons: https://www.nytimes.com/2017/05/22/technology/north-korea-ra...

It basically comes to it looking like Lazarus Group

The WannaCry attacks used the same command-and-control server used in the North Korean hack of Sony Pictures Entertainment in 2014, which wiped out nearly half of the company’s personal computers and servers.

...

Other digital crumbs linking the North Korean group to WannaCry include a tool that deletes data that had been used in other Lazarus attacks. The hackers behind WannaCry also used a rare encryption method and an equally unusual technique to cover their tracks.

[slim]

Then WikiLeaks published CIA's Marble Framework

https://wikileaks.org/ciav7p1/cms/page_14588467.html