They could be NK hackers using the service to target their next corporate ransom victim.