I did not see any Korean language references in the malware code. The rawdisk driver linked into Wiper is a reusable, publicly-available one, which has been us

I did not see any Korean language references in the malware code. The rawdisk driver linked into Wiper is a reusable, publicly-available one, which has been used for many purposes including legitimate ones, and was written by someone from South Korea. That was compiled with a Korean locale (as you'd expect). The result is a bit like saying Duplex Secure wrote Alcohol 120% because it uses the SPTD drivers - an invalid conclusion.