China-linked hackers backdoored executives' laptops via USB, exploiting a fix companies had but weren't using

In a sophisticated cyber attack, Chinese state-linked hackers compromised executive laptops at an agricultural industry conference on Hainan Island. The intrusion, known as OVERCAST PANDA, was carried out by physically accessing hotel rooms and installing a backdoor called FlowCloud on the executives' laptops via USB sticks while they were dining.

There was no network breach or phishing email involved. The intrusions occurred between March and May 2026, and CrowdStrike's senior vice president of counter adversary operations, Adam Meyers, confirmed the timeline through a VentureBeat interview. FlowCloud, which predates this campaign, had been delivered via phishing in 2020 and tracked by NTT Security on Japanese organizations since early 2022.

Physical-access tampering with an unattended laptop, also known as an "evil maid attack," is a rare occurrence in CrowdStrike's tracking of 290 adversaries. What sets this operation apart is the combination of hotel-room entry with malware deployment, bypassing the need for a user to execute a file. Once the executives powered on their laptops the next morning, FlowCloud loaded, initiating keylogging, screen capture, file collection, and credential harvesting.

CrowdStrike's Falcon security platform detected the intrusion once the process started after boot, but by then, the implant and its trigger were already on disk. The attack highlights the limitations of existing security tools, as Endpoint Detection and Response (EDR) waits for the operating system to load and the agent to run, Multi-Factor Authentication (MFA) requires a login attempt, and AI agent security relies on an active agent.

CrowdStrike announced new runtime security products at Fal.Con 2026, including Falcon Guardian, SafeMind, the Agentic Identity Provider, and AI Gateway, aiming to address these emerging threats.