IsOne is the self-given alias used by the actor behind a June 2012 intrusion into South Korean newspaper JoongAng Ilbo, in which the attacker defaced the outlet's website and attempted to wipe its news-production servers, leaving a message threatening further attacks. South Korea's National Police Agency adopted the name after finding it used as a compromised PC hostname in the attacker's infrastructure and determined the intruder had accessed the target for reconnaissance since at least April 2012, routed the attack through relay servers across roughly ten countries, and connected from IP ranges assigned to North Korea, including addresses tied to North Korea's Ministry of Posts and Telecommunications. Investigators found one relay server had also been used in a March 2011 DDoS attack and a 2011 Nonghyup bank hacking incident, and identified malware overlapping in algorithm and key values with earlier 2009 and 2011 DDoS and email-malware incidents. A later ESTsecurity analysis linked IsOne's document macro code, command-string formatting, and file-wiping technique to a subsequently discovered malicious document attributed to an author called sinbad, suggesting continued activity years afterward.