Symantec found a connection between the recent attack and one launched against U.S. and South Korean government institutions in 2011. The company believes the people behind both attacks were just doing their job because of the backdoor file’s directory path leading to where the code was compiled on disk in the creator’s computer. The path included “Z:work,” an indication that a professional was doing the compiling in a work folder. The attack last week involved malware that destroyed the master boot record on the hard drive, causing the infected system to crash.”]
Source: https://www.csoonline.com/article/2133135/hired-guns-suspected-in-south-korean-cyberattacks.html