Chinese hackers compromised executives' laptops via USB physical access
Novel attack method bypasses traditional cybersecurity defenses
1New physical access cyberattack method
China-linked hacking group OVERCAST PANDA compromised executives' laptops at an agricultural conference on Hainan Island earlier this year. Instead of traditional cyberattack methods, the perpetrators physically entered hotel rooms and infected computers via USB drives. According to CrowdStrike's 2026 Threat Hunting Report, attackers installed a backdoor called FlowCloud while targets were at dinner.
2Technical details of the attack
Between 8 PM and 9:57 PM, attackers accessed two different rooms to boot computers from USB and install FlowCloud malware. No network intrusion, phishing, or credential theft was involved. Adam Meyers, CrowdStrike's SVP of Counter Adversary Operations, noted this method is rarely used by state intelligence services. While FlowCloud has been known since 2020, this marks its first physical-access deployment.
3Critical unprotected hours
The most vulnerable period was between USB implantation and next boot. When executives powered on their laptops the next morning, FlowCloud automatically activated. During this window, computers remained compromised undetected. CrowdStrike's Falcon software could only detect the threat after OS loading completed.
4Method bypassing traditional defenses
The attack evaded EDR solutions, multi-factor authentication, and phishing training by occurring pre-OS. Meyers stated, 'The initial compromise happened below the running OS, below the EDR agent, below the authentication stack.' This novel approach highlights gaps in conventional cybersecurity models.
5China's industrial targeting
Targeting an agriculture conference aligns with China's five-year plans. A separate mid-2026 attack used similar tactics against a US media professional. Evidence suggests China's Ministry of State Security (MSS) orchestrated these operations, reflecting strategic data collection priorities.
6Hotel staff involvement
The breach method raises questions about room access. Meyers suggested either MSS/Public Security Ministry officers entered rooms, or hotel staff cooperated through bribery/coercion. While 'hotel entry is very common,' Meyers emphasized the uniqueness of combining physical access with malware deployment.
7Sector-wide threat landscape
CrowdStrike's report documented 7,400 new CVEs in June 2026 - a 96% increase year-over-year. The company responsibly disclosed 2,400 vulnerabilities, representing 30% of that month's total. AI agent-triggered detections grew 2.5x faster than human-triggered ones, indicating shifting attack vectors.
8CrowdStrike's new solutions
At Fal.Con 2026, CrowdStrike unveiled SafeMind with Nvidia CEO Jensen Huang - a cybersecurity system built on Nvidia Nemotron models and CrowdStrike threat data. Falcon Guardian provides runtime security for AI agents on endpoints. The company plans to integrate SafeMind into Guardian for malicious-prompt detection within weeks.
9Need for firmware-level defenses
Meyers noted these attacks are preventable but inconvenient solutions limit adoption. Since May 2019, CrowdStrike's Falcon sensor has detected firmware attacks and audited BIOS settings. While solutions like Dell SafeBIOS exist, industry-wide implementation remains low despite growing physical-access threats.
10New era in cybersecurity
Rising physical-access cyberattacks demand revised security strategies. Additional protections are essential for traveling executives and critical personnel. CrowdStrike's findings demonstrate traditional cybersecurity approaches are insufficient, requiring multi-layered defense strategies combining physical and digital safeguards.