That Verge article is perhaps what i was missing. Seems the threats were attached to a copy of previously unreleased emails from the Sony hack. Thus at least demonstrating that the threat is coming from someone that has access to the files from the hack.

Now if that is the same as the original hacker(s), never mind if they are actually attached to NK in any way, is another issue entirely.