LNK is the Windows shortcut-file format, not a malware family. North Korean campaigns have weaponized shortcuts disguised as official correspondence, research material, legal documents, embassy communications, investment reports, resumes, and security notices. Opening them can launch obfuscated command lines and hidden PowerShell, create VBS and BAT scripts, display decoy documents, establish scheduled-task persistence, and retrieve encrypted payloads. Kimsuky operations used GitHub for payload distribution and command and control, while an APT37 campaign installed the Python-based NarwhalRAT through malicious shortcuts and used a Korean relay server with the pCloud API.