IGLOO analyzes four LNK-based malware samples believed to be distributed by North Korea-linked Konni and Kimsuky activity. The samples are grouped into three types based on C2, code structure, and obfuscation: modular batch-file use, copied legitimate processes, and batch files disguised as .db files. Konni-associated samples use compromised domains and more complex logic, including time-derived encryption for parts of communication URLs and host-based targeting using %COMPUTERNAME%. Kimsuky-associated samples are linked to PebbleDash and RAT-style follow-on activity for remote control and additional malicious actions.