NK New Year was a January 2019 espionage operation against South Korean targets using a lure styled as a government assessment of North Korea’s New Year address. An executable opened a legitimate HWP decoy while installing architecture-specific DLLs disguised as document-software components. The malware logged keystrokes, maintained local records of infection activity, and attempted to exchange commands and stolen information through a South Korean webmail service; code similarities connected the activity to tradecraft seen in the 2014 Korea Hydro and Nuclear Power attack.