Symantec assessed that the tools and infrastructure used in WannaCry showed strong links to Lazarus, while cautioning that the technical evidence did not establish a specific nation-state motivation. Before the May 12 global outbreak, earlier WannaCry variants were used in targeted February, March, and April 2017 attacks that spread with stolen credentials rather than EternalBlue. The February victim network contained Lazarus-linked malware including Trojan.Volgmer and two Backdoor.Destover variants, while later attacks used Trojan.Alphanc, described as an evolution of Backdoor.Duuzer, and Trojan.Bravonc, which shared C2 infrastructure and code traits with Duuzer, Destover, Joanap, and other Lazarus-linked tools. Symantec also highlighted shared code between WannaCry and Backdoor.Contopee, similar archive passwords across early and global WannaCry versions, and the May addition of EternalBlue as the change that turned a limited targeted tool into a fast-spreading global ransomware outbreak.