China-linked hackers backdoored executives' laptops via USB, exploiting a fix companies had but weren't using

A Chinese state-linked hacking group compromised executive laptops at an agricultural industry conference on Hainan Island this spring — not through phishing or a network breach, but by breaking into hotel rooms and booting the machines from a USB stick while the executives were at dinner. CrowdStrike, which tracks the group as OVERCAST PANDA, disclosed the campaign in its 2026 Threat Hunting Report and detailed the operation's timeline in an interview with VentureBeat at Fal.Con 2026: an intruder entered one room at around 8 p.m. local time and a second room by 9:57 p.m., writing a backdoor called FlowCloud directly to each laptop's storage before rebooting the machines and leaving. There was no network intrusion, no phishing email, and no credential stolen through a login page.The report dates the intrusions to between March and May 2026, and the timestamps come from Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, who cleared them for publication in the VentureBeat interview. CrowdStrike's OverWatch team disrupted the intrusions and assessed that OVERCAST PANDA will almost certainly continue. FlowCloud itself predates this campaign by years: Pro…