# Chinese hackers compromised executives' laptops via USB physical access Novel attack method bypasses traditional cybersecurity defenses - **Source:** [VentureBeat (feeds.feedburner.com)](https://brifing.si/source/c51474dc-6b09-49dd-aaca-085f4ed00c84) - **Published:** 2026-09-03 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/c9e47ea3-e55a-4932-94e2-6308673d0124 ## New physical access cyberattack method China-linked hacking group OVERCAST PANDA compromised executives' laptops at an agricultural conference on Hainan Island earlier this year. Instead of traditional cyberattack methods, the perpetrators physically entered hotel rooms and infected computers via USB drives. According to CrowdStrike's 2026 Threat Hunting Report, attackers installed a backdoor called FlowCloud while targets were at dinner. ## Technical details of the attack Between 8 PM and 9:57 PM, attackers accessed two different rooms to boot computers from USB and install FlowCloud malware. No network intrusion, phishing, or credential theft was involved. Adam Meyers, CrowdStrike's SVP of Counter Adversary Operations, noted this method is rarely used by state intelligence services. While FlowCloud has been known since 2020, this marks its first physical-access deployment. ## Critical unprotected hours The most vulnerable period was between USB implantation and next boot. When executives powered on their laptops the next morning, FlowCloud automatically activated. During this window, computers remained compromised undetected. CrowdStrike's Falcon software could only detect the threat after OS loading completed. ## Method bypassing traditional defenses The attack evaded EDR solutions, multi-factor authentication, and phishing training by occurring pre-OS. Meyers stated, 'The initial compromise happened below the running OS, below the EDR agent, below the authentication stack.' This novel approach highlights gaps in conventional cybersecurity models. ## China's industrial targeting Targeting an agriculture conference aligns with China's five-year plans. A separate mid-2026 attack used similar tactics against a US media professional. Evidence suggests China's Ministry of State Security (MSS) orchestrated these operations, reflecting strategic data collection priorities. ## Hotel staff involvement The breach method raises questions about room access. Meyers suggested either MSS/Public Security Ministry officers entered rooms, or hotel staff cooperated through bribery/coercion. While 'hotel entry is very common,' Meyers emphasized the uniqueness of combining physical access with malware deployment. ## Sector-wide threat landscape CrowdStrike's report documented 7,400 new CVEs in June 2026 - a 96% increase year-over-year. The company responsibly disclosed 2,400 vulnerabilities, representing 30% of that month's total. AI agent-triggered detections grew 2.5x faster than human-triggered ones, indicating shifting attack vectors. ## CrowdStrike's new solutions At Fal.Con 2026, CrowdStrike unveiled SafeMind with Nvidia CEO Jensen Huang - a cybersecurity system built on Nvidia Nemotron models and CrowdStrike threat data. Falcon Guardian provides runtime security for AI agents on endpoints. The company plans to integrate SafeMind into Guardian for malicious-prompt detection within weeks. ## Need for firmware-level defenses Meyers noted these attacks are preventable but inconvenient solutions limit adoption. Since May 2019, CrowdStrike's Falcon sensor has detected firmware attacks and audited BIOS settings. While solutions like Dell SafeBIOS exist, industry-wide implementation remains low despite growing physical-access threats. ## New era in cybersecurity Rising physical-access cyberattacks demand revised security strategies. Additional protections are essential for traveling executives and critical personnel. CrowdStrike's findings demonstrate traditional cybersecurity approaches are insufficient, requiring multi-layered defense strategies combining physical and digital safeguards. ## Sources covering this story - https://venturebeat.com/security/china-linked-hackers-backdoored-executives-laptops-via-usb-exploiting-a-fix-companies-had-but-werent-using — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._