China-linked hackers backdoored executives' laptops via USB, exploiting a fix companies had but weren't using
VentureBeat | The Independent | Voice on AI | Orchestration | Infrastructure | Data | Security | Technology | More | Newsletters
China-linked hackers compromised executive laptops at an agricultural industry conference on Hainan Island this spring through a novel method: USB booting, bypassing traditional network and phishing attacks. CrowdStrike, tracking the group as OVERCAST PANDA, disclosed this in its 2026 Threat Hunting Report.
Timeline: An intruder entered hotel rooms around 8 p.m. local time and again at 9:57 p.m., writing a backdoor called FlowCloud directly to each laptop's storage before rebooting the machines while executives were away from their desks.
Report Details: The campaign, which occurred between March and May 2026, involved no network intrusion or stolen credentials. FlowCloud predates this incident, with Proofpoint documenting it in 2020 and NTT Security tracking USB-delivered infections since early 2022.
Attack Vector: Security researchers term such attacks "evil maid attacks," where physical access is exploited to deploy malware. In this case, the hackers entered hotel rooms while executives were at dinner and booted machines from a USB stick.
Novelty: What's unique is the combination of hotel entry by a state intelligence service with malware deployment via USB boot, bypassing existing security measures like EDR agents and MFA.
CrowdStrike's Falcon: CrowdStrike's Falcon platform detected FlowCloud after it started running, but by then the implant was already on disk. The company's AI-driven security products, introduced at Fal.Con 2026, aim to mitigate such gaps in security.
Suspected Culprits: CrowdStrike believes China's Ministry of State Security is behind OVERCAST PANDA.