The ransomware uses TLS encryption to protect its load balancer from analysis. Based on code similarities and infrastructure overlap, we can attribute this to Lazarus Group with unknown confidence.