Cyber Crime

Elon Musk confirms that Russian hackers tried to recruit Tesla employee to plant a malware

Elon Musk confirmed that Russian hackers attempted to recruit an employee to install malware into the network of electric car maker Tesla.

Recently US authorities arrested the Russian national Egor Igorevich Kriuchkov (27) after attempting to recruit an employee at a targeted company to plant a piece of malware. The man was arrested on August 22 and appeared in court on August 24. Kriuchkov offered $1 million to the unfaithful employee of the US company.

“Egor Igorevich Kriuchkov, 27, a citizen of Russia, was charged in a complaint with one count of conspiracy to intentionally cause damage to a protected computer.  He was arrested on Aug. 22, 2020, in Los Angeles and had his initial appearance before U.S. Magistrate Judge Alexander F. MacKinnon in U.S. District Court in Los Angeles, California, who ordered Kriuchkov detained pending trial.” states the DoJ’s press release.

“According to the complaint and statements made in court, from about July 15, 2020 to about Aug. 22, 2020, Kriuchkov conspired with associates to recruit an employee of a company to introduce malware.”

Kriuchkov conspired with other criminals to recruit the employee of an unnamed company in Nevada.

Now Elon Musk confirmed that the target of the hackers was his company, electric car maker Tesla.

Kriuchkov entered the United States on July 28 using his Russian passport and a tourist visa. 

The Russian man and his co-conspirators were planning to exfiltrate data from the network of the company and blackmail the organization to leak stolen data, unless the company paid a ransom demand.

According to Teslarati, the unnamed company was Tesla, Elon Musk replied to a Teslarati tweet confirming the attack.

Teslarati confirmed that the employee contacted by the crooks is a Russian-speaking, non-US citizen working at Tesla-owned lithium-ion battery and electric vehicle subassembly factory Giga Nevada.

“The employee, whose identity has not been revealed, has access to the electric car maker’s computer networks. On July 16, the Russian citizen contacted the Giga Nevada employee through WhatsApp asking to meet with him in Sparks, Nevada.” reads a post published by Teslarati. “As noted in a report from Clearance Jobs, the fact that Kriuchkov approached a Russian-speaking, non-US citizen working at Gigafactory Nevada suggests that the team behind the cyberattack attempt has done their research well. “

A few days after meeting the employee, Kriuchkov exposed his plan to the employee offering him between $500,000 and $1,000,000 for the dirty job. The malware would provide Kriuchkov and co-conspirators, the malicious code was specifically designed to steal information from Tesla.

The employee decided to warn Tesla and the company reported the attempt to the FBI. The employee had more meetings with Kriuchkov that were surveilled by the FBI. On August 22, the FBI arrested Kriuchkov.

Pierluigi Paganini

(SecurityAffairs – hacking, Tesla)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Over 80,000 servers hit as Roundcube RCE bug gets rapidly exploited

A critical remote code execution (RCE) vulnerability in Roundcube was exploited days after patch, impacting…

5 hours ago

A flaw could allow recovery of the phone number associated with any Google account

A vulnerability could allow recovery of the phone number associated with a Google account by…

10 hours ago

Texas Department of Transportation (TxDOT) data breach exposes 300,000 crash reports

Hackers breached Texas DOT (TxDOT), stealing 300,000 crash reports with personal data from its Crash…

21 hours ago

SAP June 2025 Security Patch Day fixed critical NetWeaver bug

SAP fixed a critical NetWeaver flaw that let attackers bypass authorization and escalate privileges. Patch…

23 hours ago

U.S. CISA adds RoundCube Webmail and Erlang Erlang/OTP SSH server flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds RoundCube Webmail and Erlang Erlang/OTP SSH server flaws…

1 day ago

Mirai botnets exploit Wazuh RCE, Akamai warned

Mirai botnets are exploiting CVE-2025-24016, a critical remote code execution flaw in Wazuh servers, Akamai…

1 day ago