In September 2023, someone looked up an MGM Resorts employee on LinkedIn, called the IT help desk claiming to be that person, and talked their way into the network. The call lasted about ten minutes. The outage lasted ten days. MGM reported roughly $100 million against its third quarter results and committed up to $40 million to security improvements.
No malware was involved in getting in. No zero day. The help desk did what a help desk is trained to do, which is help.
The technique that beat a $33 billion company was older than the computer it was used against. It is called elicitation, and counterintelligence services have been documenting it for a century.
The cycle has five steps and none of them are technical
Intelligence services describe recruitment as a sequence: spot, assess, develop, recruit, handle. It was built to describe turning a foreign official. It describes what happened to MGM without modification.
Spot. Identify someone with the access you want. Scattered Spider used LinkedIn. Job titles, reporting lines, and tenure are published voluntarily by nearly every employee of every company.
Assess. Gather enough detail to pass as them. MGM's help desk verification relied on knowledge-based questions: full name, employee ID, date of birth. Every one of those is either public or purchasable.
Develop. Build a reason for the contact to feel routine. A phone call from a locked-out colleague on a Tuesday is routine.
Recruit. Ask for the thing. In a vishing call, the ask is a password reset. The help desk agent never knows they were the target.
Handle. Keep the access working. Scattered Spider had MFA disabled on the compromised account, which converted a ten-minute call into persistent access.
The security industry files that under social engineering and moves on. Counterintelligence treats it as a documented adversary methodology with named phases and observable indicators, which is a considerably more useful frame if you want to interrupt it.
The version that takes months instead of minutes
In July 2020, a Russian national named Egor Kriuchkov contacted an employee at Tesla's Nevada Gigafactory over WhatsApp. They had met once, in 2016. He proposed drinks.
Over the following weeks there were social outings, a trip to Lake Tahoe with colleagues, expenses covered. Then the pitch: introduce malware to Tesla's network, the group would exfiltrate data and extort the company, and the employee would receive $1 million of a planned $4 million ransom. Kriuchkov supplied a burner phone and instructions to keep it in airplane mode until payment cleared.
The employee reported it. The FBI ran a sting, and Kriuchkov was arrested in Los Angeles attempting to leave the country. He pleaded guilty in March 2021.
Same five phases. Different timescale, different price, identical structure. Kriuchkov told the employee this was normal practice for his group, that they routinely paid insiders to plant malware and covered the theft with a denial of service attack.
What made the Tesla case work was not a control. No data loss prevention product caught it. No monitoring alerted. It worked because one employee recognised a recruitment approach and told someone. That is a trained behaviour, and it is trainable, but almost no awareness program teaches what an approach looks like from the inside.
Why this belongs in cybersecurity and usually is not
The two disciplines developed separately and use different words for the same events.
A security team calls the MGM incident a vishing attack against the service desk and fixes it with better identity verification. That is correct, and it is also the narrowest possible reading. A counterintelligence analyst sees an adversary who completed a recruitment cycle against an organisation whose personnel data was fully exposed, whose verification process trusted public facts, and whose staff had no framework for recognising an approach.
The second reading produces different controls.
Verification must use something an attacker cannot look up. Knowledge-based authentication at the help desk is the single most exploited weakness in this class of attack. Callback to a known number, manager confirmation, or an in-band prompt to a registered device all break the pattern. MGM's process did not.
Treat the org chart as an attack surface. You cannot stop employees using LinkedIn. You can know what your published footprint enables, which is what an exposure assessment is for.
Teach the approach, not just the phish. People are trained to spot a suspicious email. Almost nobody is trained to notice that a former colleague has become unusually interested in their work, or that a new contact keeps steering toward what systems they can reach.
Make reporting an approach socially survivable. The Tesla employee had to volunteer that a friend tried to bribe them. Most people will not do that if they suspect it makes them a suspect. Insider threat programs that read as surveillance produce silence, and silence is what the recruiter is counting on.
Assume the help desk is a target and staff it accordingly. It sits at the intersection of maximum trust and minimum authority to say no. Give the agents an explicit, blameless path to refuse and escalate.
The uncomfortable part
Both cases turned on a person, and in both cases the person was the last line of defence rather than the first.
At Tesla it held. At MGM it did not, and the difference was not the calibre of the employee. It was whether anyone had ever described to them what was about to happen.
That is the whole argument for counterintelligence-informed awareness training. Not that people are the weakest link, which is a lazy formulation that mostly serves vendors. It is that the adversary is running a documented methodology against your workforce, and your workforce has never been shown the playbook.
Sources
The MGM timeline draws on public reporting including TechCrunch and MGM's own disclosures on financial impact. The Tesla case is documented in the Department of Justice complaint and Kriuchkov's guilty plea of March 2021. The recruitment cycle terminology is standard in counterintelligence literature and appears in Carnegie Mellon SEI's insider threat curriculum.