My understanding is that NK works out of a Chinese city Shenyang. [1] Their lack of internet infrastructure does not really matter in that case. As well, if they are working out of China you have to assume they are exchanging information with China. China has some pretty top tier security experts. I do not think it is unreasonable at all for someone in NK to be trained up in how to write ransomware or a wiper.

1. https://www.businessinsider.com/north-korean-hackers-working...