In September 2023, attackers claimed they used a public employee profile and a call to MGM Resorts' I.T. help desk to gain access. TechCrunch reported the claim; MGM did not confirm that entry sequence in its public filing. What MGM did disclose was a major disruption and an estimated $100 million negative impact to adjusted property earnings.
The public account of the entry point is worth studying because it asks a familiar question: how does a service desk help a real employee without granting the same help to someone pretending to be them?
That is a counterintelligence question. The attacker had an objective, sought a route to access, and used information about a person to make the request believable. Treating the event as merely "someone fell for a phone call" misses the method.
Start with the attacker's requirement. A help-desk impersonator needs the desk to treat a caller as an employee. The defender's job is to verify identity through a route the caller cannot supply or control.
Different methods, the same three questions
Counterintelligence asks what the adversary wants, who or what gives them access, and what information or pressure can move that person or process. Those questions do not turn every scam into a spy operation. They help a business spot the attack path before the request arrives.
In the reported MGM sequence, the objective was account access, the route was the help desk, and the useful material was public employee information. The lesson is not "trust nobody." It is to make identity checks depend on a known channel or established procedure, not details a caller can research.
That is impersonation. Recruitment is different: an adversary tries to persuade a real person to misuse the access they already have. The attempted attack on Tesla in 2020 shows that second path.
The approach that tried to create an insider
In 2020, Egor Kriuchkov contacted an employee at Tesla's Nevada Gigafactory whom he had met years earlier. Tesla later confirmed it was the target. Kriuchkov traveled to meet the employee and spent weeks developing the relationship. The purpose was not to impersonate the employee. It was to recruit them.
Kriuchkov offered the employee $1 million to put malware on the company's network. His group planned to steal data and use it for extortion. He supplied a burner phone and instructions to leave it in airplane mode until payment. These details appear in the Justice Department's account of the case.
The employee reported the approach. The company contacted the Federal Bureau of Investigation, and the plot was stopped before the malware was installed. Kriuchkov pleaded guilty in March 2021.
This was a real recruitment attempt. The employee was the defender who made the difference, not the weak link the attacker hoped to create.
| Case | Attacker's objective | Route to access | What could interrupt it |
|---|---|---|---|
| MGM, as publicly reported | Take over an employee account | Impersonate an employee to the help desk | Verify identity through a trusted process that does not rely on public facts |
| Tesla recruitment case | Put malware inside the network | Recruit a real employee with trusted access | Give the employee a safe reporting path and act on the report |
The report was the detection. The employee recognized the recruitment attempt and told the company. That gave the company and the FBI time to act before malware reached the network. Training should show people what an approach looks like and what happens when they report it.
What the two cases change
The cases do not share a five-step script. They share an adversary who understood which human or process could provide access. That difference matters because the defenses are different.
Make help-desk verification resistant to research. A caller who knows an employee's title, manager, and recent project has not proved their identity. Use a known verification route and give desk staff room to stop a convincing request.
See what your public footprint gives away. You cannot stop employees from using LinkedIn. You can check whether public roles, vendors, documents, and services make impersonation easier, then tighten the process an attacker would target.
Teach people to recognize a recruitment approach. A former contact who becomes unusually interested in systems, access, or internal routines is not just a suspicious email. People need to know they can report that approach without becoming the suspect.
Answer the report. The Tesla employee reported the proposal, and the company acted. That loop is a security control. Silence after a report teaches the opposite lesson.
People are part of the defense
The old weakest-link story asks which employee failed. A counterintelligence focused program asks what the adversary needed, what made the approach believable, and which decision could interrupt it. The answer may be an identity check, a different approval path, or a person who reports what they saw.
We train the person and strengthen the process around them. Neither works well alone.
Praeven brings this counterintelligence focused approach to security programs and live briefings. We connect what an attacker could learn to the access, verification, and reporting decisions your organization can improve.
Explore the Security ProgramBring this to your team
Sources
The MGM entry sequence is based on TechCrunch's reporting of the attackers' claim. Its financial impact comes from MGM's SEC filing. The recruitment details are in the Justice Department's 2020 account; TechCrunch reported Tesla's confirmation, and the 2021 guilty-plea announcement confirms the outcome.