RED × BLUE

Threat Playbook

Adversary vectors paired with the defensive controls that close them. Read top-to-bottom — engagements are sorted by severity. Baseline controls below apply across the surface.

Severe

Moderate

Low

Baseline

Severe · Act Now

3 engagements

SEVERE R-01 ↔ B-01 Spear-phishing em@spacex.com with breach-correlated pretexting High confidence

Red · Adversary Vector R-01

Spear-phishing `em@spacex.com` with breach-correlated pretexting

The em@spacex.com inbox is publicly verifiable as authentic via the April 2019 r/TeslaLounge thread (ev_009) where users reported outbound-validation success. GitHub code search confirmed the literal address is not present in production repositories (ev_025) — limiting one credential-leak vector but not the phishing surface. An adversary's likely path: pull X Corp breach corpuses (200M April 2025 + 2.8B March 2025 + 200M Jan 2023, ev_028) for any correlated identifiers → craft pretext using known communication patterns (2018 Tesla all-hands; 2024-2025 OpenAI litigation correspondence) → deliver via gateway-evading channel. Very likely the highest-payoff identity-targeted vector against Musk personally.

Blue · Defensive Control B-01

Rotate `em@spacex.com`; deploy executive-protection email gateway

Rotate the em@spacex.com address to a new convention untied to initials, or migrate Musk's authoritative correspondence to a non-published mailbox routed through an executive-protection email gateway (Material, Abnormal, Egress, or equivalent). The current address has been publicly known for at least seven years (Reddit 2019, ev_009); rotation is overdue. Pair with: out-of-band confirmation requirements for any unusual request claiming to originate from Musk; gateway anomaly detection tuned for high-profile-target threat models.

SEVERE R-02 ↔ B-02 Account-takeover surface on owned platform via inherited breach exposure Moderate confidence

Red · Adversary Vector R-02

Account-takeover surface on owned platform via inherited breach exposure

Musk's primary social presence is x.com/elonmusk (ev_007) on a platform whose corporate-side breach history is severe (ev_028): 200M email leak (April 2025), 2.8B profile leak (March 2025 alleged insider), 200M+ scrape (January 2023). Even with platform-owner-level controls, the credential corpuses are public and the account is high-value (213M+ followers, audience scale). Adversary path: extract any @elonmusk-linked records from breach data → identify token / secondary-recovery patterns → exploit. Confidence moderate because the platform-owner can apply protections invisible to passive recon (out-of-band MFA, anomaly detection); the underlying exposure surface, however, is very likely live.

Blue · Defensive Control B-02

Hardware-key MFA on @elonmusk; out-of-band recovery review

Enforce hardware-key MFA (FIDO2 / YubiKey) on the @elonmusk account and all administrative roles tied to X Corp infrastructure. Review and harden account-recovery flows — assume any email or phone-number identifier visible in prior breach corpuses (ev_028) is compromised. Implement out-of-band recovery requiring multi-party authorization for the highest-profile accounts. Audit any session tokens that may have predated the most recent X Corp breach events.

SEVERE R-04 ↔ B-04 Federal-SSO endpoint auth.spacex.com as a high-value SAML target Moderate confidence

Red · Adversary Vector R-04

Federal-SSO endpoint `auth.spacex.com` as a high-value SAML target

The DirectFedAuthUrl=https://auth.spacex.com TXT record (ev_020) and SPF inclusion of spf.protection.office365.us (Microsoft 365 GOV cloud) very likely indicate a federal-tenant SSO broker for SpaceX's classified or controlled-unclassified work — likely paralleling the Starshield / NRO contract surface. An adversary path: enumerate SANs of auth.spacex.com via CT logs (not enumerated this run — recon gap, ev_020 only); fingerprint IdP technology (Entra Government vs ADFS vs third-party); attempt known SSO attacks (Golden SAML if AD-backed, token replay, IdP-spoofing). The federal-contractor context elevates payoff substantially over a typical corporate SSO. Confidence moderate; severity severe if exploited.

Blue · Defensive Control B-04

CT-log monitoring + SAML hardening on `auth.spacex.com`

Enumerate the full SAN structure of auth.spacex.com via internal cert inventory, then verify each SAN against expected federal-tenant assets — identifying any forgotten dev / staging endpoints. Subscribe to CT-log monitoring (e.g., Cert Spotter, Censys CT-logs) for the spacex.com root. Audit IdP configuration: enforce SAML token-signing certificate hygiene, replay-cache TTLs, audience restrictions, encrypted assertions. If on Microsoft Entra Government, enable Token Protection (TPM-bound tokens) and Conditional Access Authentication Context for sensitive contracts.

Moderate · Plan Mitigation

3 engagements

MODERATE R-03 ↔ B-03 Family-map pretexting against inner-circle support staff High

Red R-03

Family-map pretexting against inner-circle support staff

Recon surfaced the full family structure: parents Maye Musk and Errol Musk, siblings Kimbal Musk and Tosca Musk (ev_010); 14 children with four women — Justine Wilson (six children: Nevada deceased, Vivian, Griffin, Kai, Saxon, Damian), Grimes (Claire Boucher) (three: X Æ A-Xii, Exa, Techno), Shivon Zilis (four: Strider, Azure, Arcadia, Seldon), Ashley St. Clair (one) — per ev_011 and ev_026. The Vivian Wilson estrangement is publicly reported and is very likely a high-value pretexting hook ("daughter in crisis" social-engineering). Vector applies to executive assistants, security detail, and any out-of-band-request handlers across Tesla, SpaceX, xAI, Neuralink, Boring Co.

Blue B-03

Codified pretexting-resistance protocols for inner-circle staff

Codify and rehearse pretexting-resistance protocols for executive assistants, security detail, and any chief-of-staff function: a published code-word or out-of-band confirmation channel for any request claiming to originate from a family member, especially the publicly-estranged daughter Vivian Wilson (ev_011) where social-engineering pretexts have the highest emotional traction. Run quarterly tabletop exercises that include family-themed pretexts; track response-rate metrics; provide private feedback loops without naming individuals.

MODERATE R-05 ↔ B-05 Personal domain elonmusk.com hosted as AWS S3 static redirect, no DNSSEC Moderate

Red R-05

Personal domain `elonmusk.com` hosted as AWS S3 static redirect, no DNSSEC

elonmusk.com is privately registered (Network Solutions WHOIS proxy 194b7f7ac72e540cs@networksolutionsprivateregistration.com, ev_005); A-records point to multiple AWS S3 IPs (16.15.x, 52.217.x, 54.231.x); DNSSEC is unsigned. Wayback evidence (ev_004) shows 2008-2014 historical content was SpaceX-branded — meaning the domain has personal-identity significance but is operationally treated as a passive static-redirect asset. Risk vectors: (a) bucket-takeover if S3 bucket name is reused; (b) sub-domain dangling if any CNAMEs target unclaimed AWS endpoints; (c) no DNSSEC raises DNS cache-poisoning surface; (d) any registrar lapse enables full domain hijack — Network Solutions has prior history of credential-based domain hijacks. Likely a low-frequency but high-credibility-of-impersonation vector if exploited.

Blue B-05

DNSSEC enablement + registrar-lock + bucket-takeover audit for elonmusk.com

Enable DNSSEC on elonmusk.com (currently unsigned per ev_005). Verify registrar-lock status at Network Solutions and enforce multi-factor on the registrar account. Audit the AWS S3 buckets backing the current static redirect — confirm bucket-name ownership is non-recyclable; verify there are no dangling CNAMEs to AWS endpoints that could be re-registered. Consider moving to an A-record / CloudFront distribution with explicit ownership rather than direct S3 hosting to reduce takeover surface.

MODERATE R-06 ↔ B-06 Lateral-trust chain across Musk-controlled orgs via shared vendor identity stack Low

Red R-06

Lateral-trust chain across Musk-controlled orgs via shared vendor identity stack

Tesla (ev_021: Atlassian, OneTrust, LogMeIn, Cursor, Adobe IDP, Apple), SpaceX (ev_020: Atlassian, Office 365 GOV, Proofpoint, Stripe, Shopify), Neuralink (ev_022: Anthropic, Tailscale, Atlassian, Figma, Slack, Cursor), and Boring Co (ev_023: NetSuite, Amazon SES) share a meaningful vendor footprint. While each org is corporately distinct, the personnel overlap (Musk at all four; Shivon Zilis at Neuralink with cross-pollination via the children-with-Musk relationship) creates plausible identity-trust links that an adversary likely attempts to exploit. Confidence low because the actual SAML / OIDC trust relationships are not externally visible; the inference rests on shared vendor inventories rather than confirmed federated-trust configurations.

Blue B-06

Cross-corp identity-trust audit; segment SAML / OIDC federation

Commission a cross-corp identity-trust audit across Tesla, SpaceX, Neuralink, Boring Co, and X Corp/xAI. Map every SAML federation, OIDC trust, SCIM provisioning relationship, and shared service principal across the five orgs. Where federations exist purely for executive convenience, segment them — Musk should hold separate, audit-distinct identities per organization to prevent a single compromise from cascading. Audit the shared Atlassian / Slack / Cursor / GitHub footprints for cross-tenant guest accounts.

Baseline · Surface-Wide

2 controls

B-07 Baseline

Bug-bounty / VDP parity across Musk-controlled orgs

Tesla operates a Bugcrowd VDP (ev_021); xAI publishes a HackerOne verification (h1-domain-verification on x.ai, ev_030). Neuralink, The Boring Company, SpaceX (consumer side), and X Corp have no surfaced VDP. Establish at minimum a published security.txt and a coordinated-disclosure email / portal across all five orgs. The cost is near-zero; the asymmetry (some orgs have it, others don't) is exploitable by adversaries who target the unmonitored disclosure surface.

B-08 Baseline

DMARC `p=reject` enforcement across all Musk-controlled domains

Audit and enforce p=reject DMARC policy across elonmusk.com, spacex.com, tesla.com, neuralink.com, boringcompany.com, x.com, x.ai. Several of the surfaced SPF records (ev_023 for boringcompany.com uses ~all softfail rather than -all strictfail) indicate at least one domain is not in hard-reject posture. Brand-impersonation phishing is a primary collateral risk given Musk's public profile.

Spear-phishing em@spacex.com with breach-correlated pretexting

Rotate em@spacex.com; deploy executive-protection email gateway