That concludes security company Flashpoint after a linguistic analysis. The style and accuracy of the texts suggest that the writers come from southern China.
Link
Moreover, the analysis points to creators who speak good English. However, a serious grammatical error in this language was found, indicating that English is not the mother tongue of the creators. The English text was used as a basis for translations in Google Translate, including Dutch.
Previous evidence pointed to the hacker group Lazarus Group as responsible for the WannaCry ransomware. This group reportedly works for the North Korean state and is said to be based in China.