You could start to look at the spread of Diskcoder.C across several attacks and the shared code with ExPetr and NotPetya... This forms the basis for the DOJ indictment against 6 officers of GRU Unit 74455.
There is much more if you care to go down that rabbit hole.
Oh nonsense, that was well established to be an edit of the binary. It’s obvious the GRU didn’t have the source code. The idea that this was an example of the GRU working with criminal hackers is plainly ridiculous.
There is much more if you care to go down that rabbit hole.