WannaCry is presented as a highly destructive ransomware outbreak with strong evidence linking it to Lazarus, reportedly operating from North Korea, and the source uses it to examine wider collateral damage from worm-like malware connected to DPRK cyber activity. AlienVault details Rivts, a USB and hard-drive file-infecting worm first publicly seen from the Voice of Korea site, whose infection logic references DPRK Korea Computer Center software such as Nnr60.exe and Hana80.exe. The report assesses several explanations for Rivts and says the most likely is that it was developed inside the DPRK, while noting it may have been a prototype or learning project without an identified backdoor component. It also contrasts Rivts with Faedevour, a worm served through a compromised KCNA site and later found on IBM and Lenovo installation USB media, showing how worms can keep spreading long after their original operation or accidental release.