Unit 42 analyzes two new KimJongRAT stealer variants, one PE-based and one PowerShell-based, both initiated by Windows LNK files that retrieve droppers from attacker-controlled content hosted on a legitimate CDN service. The PE chain uses cmd.exe, curl.exe, mshta.exe, certutil.exe, and rundll32.exe to download an HTA file, drop a decoy PDF, user.txt, and a sys.dll loader, then fetch RC4-encrypted payloads named net64.log and main64.log. The loader decrypts and executes the stealer and orchestrator components, while the orchestrator provides C2 communication, backdoor functionality, victim identification, keylogging, clipboard capture, and handling of stolen data. Both variants collect victim and browser data including cryptocurrency-wallet extension data, with the PE variant also collecting FTP and email client information and the PowerShell variant deploying stealer and keylogger scripts.