Cyber security researchers with Symantec and Kaspersky Lab on Monday said they uncovered technical evidence that indicates North Korea may have been involved in last weekend’s international ransomware attack.

The WannaCry software used in the attack was found in programs used by the Lazarus Group, which the researchers said is a North Korean-operated hacking entity.