GoKawiilOVERCAST PANDA breached executive laptops with in-person USB attacks in Hainan hotel rooms
CrowdStrike says the China-linked group OVERCAST PANDA physically entered hotel rooms of executives attending an agricultural conference on Hainan Island between March and May 2026, booting their unattended laptops from a USB drive to install the FlowCloud backdoor while the victims were at dinner. No phishing, credential theft, or network intrusion was involved—the attackers relied entirely on physical access to unlocked, unattended devices. CrowdStrike's OverWatch team detected and disrupted the intrusions and expects the group to keep using this method.