It could be as simple as they saw a bunch of UDP traffic with a spoofed src that was a dprk ip block.