References?

What I remember is a well-argued article pointing to many parts of the hack that would seem to disqualify North Korea - for example the use of a (South) Korean language locale which North Koreans would in fact not normally be able or likely to use, broken English with little relation to how North Koreans would speak, etc.

Now, North Korean could be making a careful effort to impersonate Western hackers making a crude effort to impersonate North Koreans. But that's kind of reaching and there's a bit more than no evidence.