Basing your malware on a tool leaked from the NSA probably makes it easier.

https://en.m.wikipedia.org/wiki/EternalBlue

I donno, from a technical standpoint it never seemed to me like WannaCry was extremely complicated. I actually described a Ransomware with a very similar crypto scheme on here not that long ago [0], and I don't have tons of crypto experience past taking a class on it in college. With that said I'm sure there are other ransomwares out there that already do something very similar (or even the same).

The more complicated part was the propagation via the exploit, but at the same time the exploit was already out in the open. That was part of the reason it only infected old or non-updated machines. So still not easy, but a good chunk of the initial work was done for them.

[0] https://news.ycombinator.com/item?id=13147605

Not that suprising, remember that they also hacked Sony. The Lazarus group (one of the names for the DPRK APT group) is pretty sophisticated.

The major concern for the US military when attacking North Korea was not nukes, but military hackers inside a bunker disrupting everything. There probably is a lot of know-how there. The Sony hack was also attributed to North Korea.

Maybe they contracted it out.