South Korean police attributed the June 2012 JoongAng Ilbo intrusion to North Korean-linked activity by an attacker using the alias IsOne after examining compromised newspaper production systems, logs, malware, and relay servers. The attacker prepared from around April, reconnoitered the production environment, compromised an administrator PC, stole server-management information, defaced the website, and deleted some production-system data, with investigators citing North Korean IP access, reused relay infrastructure, and malware overlaps with earlier North Korea-attributed incidents.