[Quot]

From the article: "The shellcode used in this exploit is constructed in a similar manner to shellcode observed in previous North Korean exploits."

[andreygrehov]

Got it. Missed that part. Thank you. Looks like a pure assumption. According to CyberProof [1] and CloudFlare [2], the majority of attacks originate from China and the United States. North Korea is not even making it to Top 10. That's why I asked.

[1] https://blog.cyberproof.com/blog/which-countries-are-most-da...

[2] https://blog.cloudflare.com/ddos-attack-trends-for-2021-q4/

[throwawayapples]

North Korea is a nice foil, because then you don't have to cast aspersions onto trading partners.

"Look, see? NK. We even copied some Korean words into the comments."

[tough]

Isn't NK a small china protectorate anyways?

[ponorin]

The NK government-backed hacker groups mostly operate in China.