According to the Sophos X-Ops cybersecurity research team, the attack began with Qilin gaining network access through an organization's compromised VPN credentials that were lacking multi-factor authentication.
Article Link: Qilin group observed using custom tool for widespread credentials theft | SC Media