In September 2023, someone looked up an MGM Resorts employee on LinkedIn, called the IT help desk claiming to be that person, and talked their way into the network. The call lasted about ten minutes. The outage lasted ten days. In its October 2023 SEC filing, MGM estimated a $100 million impact on adjusted property earnings and reported less than $10 million in one-time expenses, including technology consulting and legal fees.
No malware was involved in getting in. No zero-day exploit was reported as the initial entry point. The help desk did what a help desk is trained to do, which is help.
The technique that beat a $33 billion company was older than the computer it was used against. It is called elicitation, and counterintelligence services have been documenting it for a century.
The cycle has five steps and none of them are technical
Intelligence services describe recruitment as a sequence: spot, assess, develop, recruit, handle. It was built to describe turning a foreign official. Here, the cycle is used as an analytical lens for the reported MGM attack, rather than as proof that the attackers followed a formal intelligence process.
Spot. Identify someone with the access you want. Scattered Spider used LinkedIn. Public profiles can reveal job titles, reporting relationships, and tenure.
Assess. Gather enough detail to pass as them. Public and exposed personal details can make an impersonation attempt more convincing. A verification process that relies only on facts an attacker can obtain is vulnerable.
Develop. Build a reason for the contact to feel routine. A phone call from a locked-out colleague on a Tuesday is routine.
Recruit. Ask for the thing. In a vishing call, the ask is a password reset. The help desk agent never knows they were the target.
Handle. Keep the access working. Scattered Spider had MFA disabled on the compromised account, which converted a ten-minute call into persistent access.
The security industry files that under social engineering and moves on. Counterintelligence treats it as a documented adversary methodology with named phases and observable indicators, which is a considerably more useful frame if you want to interrupt it.
The version that takes months instead of minutes
In July 2020, a Russian national named Egor Kriuchkov contacted an employee at Tesla's Nevada Gigafactory over WhatsApp. They had met once, in 2016. He proposed drinks.
Over the following weeks there were social outings, a trip to Lake Tahoe with colleagues, expenses covered. Then the pitch: introduce malware to Tesla's network, the group would exfiltrate data and extort the company, and the employee would receive $1 million of a planned $4 million ransom. Kriuchkov supplied a burner phone and instructions to keep it in airplane mode until payment cleared.
The employee reported it. The FBI ran a sting, and Kriuchkov was arrested in Los Angeles attempting to leave the country. He pleaded guilty in March 2021.
Same five phases. Different timescale, different price, identical structure. Kriuchkov told the employee this was normal practice for his group, that they routinely paid insiders to plant malware and covered the theft with a denial-of-service attack.
What made the Tesla case work was not a control. No data loss prevention product caught it. No monitoring alerted. It worked because one employee recognized a recruitment approach and told someone. That is a trained behavior, and it is trainable, but almost no awareness program teaches what an approach looks like from the inside.
Why this belongs in cybersecurity and usually is not
The two disciplines developed separately and use different words for the same events.
A security team calls the MGM incident a vishing attack against the service desk and fixes it with better identity verification. That is correct, and it is also the narrowest possible reading. A counterintelligence analyst sees an adversary who completed a recruitment cycle against an organization whose personnel data was fully exposed, whose verification process trusted public facts, and whose staff had no framework for recognizing an approach.
The second reading produces different controls.
Verification must use something an attacker cannot look up. Knowledge-based authentication can expose the help desk to impersonation. Use established verification procedures and escalation paths instead of accepting a caller’s claims at face value.
Treat the org chart as an attack surface. You cannot stop employees from using LinkedIn. You can know what your published footprint enables, which is what an exposure assessment is for.
Teach the approach, not just the phish. People are trained to spot a suspicious email. Almost nobody is trained to notice that a former colleague has become unusually interested in their work, or that a new contact keeps steering toward what systems they can reach.
Make reporting an approach socially survivable. The Tesla employee had to volunteer that a friend tried to bribe them. Most people will not do that if they suspect it makes them a suspect. Insider threat programs that read as surveillance produce silence, and silence is what the recruiter is counting on.
Assume the help desk is a target and staff it accordingly. It sits at the intersection of maximum trust and minimum authority to say no. Give the agents an explicit, blameless path to refuse and escalate.
The uncomfortable part
Both cases turned on a person, and in both cases the person was the last line of defense rather than the first.
At Tesla it held. At MGM it did not, and the difference was not the caliber of the employee. The cases illustrate why recognition, reporting, and reliable identity verification need to work together.
That is the whole argument for counterintelligence-focused awareness training. The weakest-link framing survives because it sells products. The operational description is more useful: the adversary is running a documented methodology against a workforce that has never been shown the playbook.
The recruitment cycle is taught in full in module 09 of the Tradecraft Series, where the indicators are framed protectively rather than as peer monitoring.
Sources
The MGM timeline draws on public reporting including TechCrunch and MGM's own disclosures on financial impact. The Tesla case is documented in the Department of Justice’s announcement of Kriuchkov’s guilty plea in March 2021. The recruitment cycle terminology is standard in counterintelligence literature and appears in Carnegie Mellon SEI's insider threat curriculum.