Kaspersky Securelist
APT Trends report, Q1 2017 (DPRK-related paragraph 3) · 2017-04-27
Interestingly, the BlueNoroff group planted Russian words within the code, to derail investigators and avoid attribution. The code contained grammar errors a native Russian speaker wouldn’t make, and sentences were likely translated using online tools.