It adds up quickly. For North Korea the revenue from "criminal enterprises", including hacking and ransomware, are a valuable source of foreign currency.

At the very least, $5M seems a good start to fund an ongoing effort at developing cyber attack capabilities.