# Qilin ransomware claims Impact Centre Chrétien

Published: 2026-08-08 · Severity: severe · Sectors: non-profit
Canonical: https://vorant.io/reports/6474b895-ed04-5660-ab66-89ca8535c3e7/qilin-ransomware-claims-impact-centre-chr-tien

> Qilin ransomware gang lists Impact Centre Chrétien as a victim, with FortiOS VPN credentials exposed via the FortiBleed flaw.

Ransomware.live has indexed a new victim posting attributed to the Qilin ransomware operation, targeting the organization Impact Centre Chrétien. The listing reports 161 compromised user accounts, 11 sets of third-party employee credentials, and 16 externally exposed attack-surface assets tied to the victim's domain.

Notably, the entry indicates the victim's FortiOS SSL-VPN credentials were exposed as part of the historical "FortiBleed" leak (CVE-2022-40684), an authentication bypass vulnerability in FortiOS/FortiProxy. This suggests initial access or credential compromise may trace back to unpatched or previously exploited Fortinet SSL-VPN infrastructure, a common vector leveraged by ransomware affiliates for initial network entry. No specific IOCs, file hashes, or additional technical details were provided in the source listing beyond the leak site posting itself.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40684 (KEV)
- Threat actors: qilin
- Malware: Qilin

## Detection guidance (public sample)

### Suspicious VPN Client Process Execution from User Context

ATT&CK: T1078

Detects execution of VPN client software (FortiClient, OpenVPN, etc.) from user temp or AppData directories, indicative of compromised credentials being used to establish remote access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious VPN Client Process Execution from User Context
description: Detects VPN client binaries executed from user-writable locations (temp,
  AppData, Downloads) rather than Program Files, suggesting lateral movement or persistence
  via compromised credentials.
tags:
- attack.lateral-movement
- attack.t1078
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \forticlient.exe
    - \forticlient_launcher.exe
    - \openvpn.exe
    - \openvpn-gui.exe
    Image|contains:
    - \AppData\
    - \Temp\
    - \Downloads\
    - \Local Settings\
  filter_legitimate_installers:
    ParentImage|endswith:
    - \msiexec.exe
    - \setup.exe
    - \installer.exe
  condition: selection and not filter_legitimate_installers
falsepositives:
- Portable VPN clients launched from user Downloads during legitimate remote access
  setup
- IT-managed deployment of VPN software to temp staging areas
level: medium
id: e83329a3-a134-5ebe-b0a2-459121de8b6e
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/SW1wYWN0IENlbnRyZSBDaHLDqXRpZW5AcWlsaW4=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6474b895-ed04-5660-ab66-89ca8535c3e7/qilin-ransomware-claims-impact-centre-chr-tien.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup