China-linked hackers backdoored executives' laptops via USB, exploiting a fix companies had but weren't using

A Chinese state-linked group called OVERCAST PANDA accessed executive laptops at a Hainan Island agricultural conference by entering hotel rooms and installing the FlowCloud backdoor via a bootable USB stick between March and May 2026. The malware activated on the next boot, performing keylogging, screen capture, file collection and credential harvesting while bypassing EDR and MFA. CrowdStrike’s OverWatch team detected the implant after launch, highlighting the novel use of physical-access entry combined with low-level firmware infection.