Two analytics firms have attributed the incident to a North Korean hacking unit called TraderTraitor.