Operation Holiday Wiper is a January 2019 variant of the state-sponsored Rocket Man campaign targeting South Korean interests, including defectors and organizations concerned with North Korea. It replaced earlier HWP exploitation with a malicious spreadsheet themed around Lunar New Year gift pricing and instructed recipients to enable content, triggering a macro and PowerShell-based download chain. The payload impersonated a well-known Korean portal security product and included destructive behavior, while reused author metadata and implementation traits connected the activity to earlier Rocket Man operations.