Ransomware - Vulnerability

Microsoft Defender for Endpoint detects North Korean threat actor activity with specific alerts by threat group, as well as captures additional activity with the alert Suspicious activity linked to a North Korean state-sponsored threat actor has been detected. 

The objectives of nation-state threat actors linked to North Korea are diverse, encompassing espionage, financial gain, and politically motivated disruption or destruction.
Microsoft Threat Intelligence researchers have increasingly observed some of these threat actors widening their missions to encompass multiple goals within the same operation, blurring the lines between traditional intelligence operations and cybercrime.

Understanding the targeting and objectives of North Korean state-sponsored threat actors is essential for the organizations most at risk of being impacted. By hardening cloud identities and on-premises credentials, defending against spear-phishing attacks, and limiting malware execution and lateral movement through the deployment of attack surface reduction rules, organizations can significantly slow down motivated state-sponsored threat actors and buy time for defenders to respond.

Source (read more)
https://security.microsoft.com/threatanalytics3/b24de28e-e504-4266-ae56-902d1abed27c/overview