Hackers Invade Hotel Rooms for Cyberattack

A state-linked Chinese hacking group, identified as OVERCAST PANDA, executed a novel cyberattack by physically entering hotel rooms on Hainan Island to compromise executive laptops. This campaign, spanning between March and May 2026, involved intruders entering unattended rooms during evening hours. They utilized a USB stick to install FlowCloud malware directly onto the laptops before rebooting them.

This tactic, known as an 'evil maid attack,' bypassed traditional security defenses, including phishing emails, network intrusions, and credential theft. The malware would activate upon the executive powering on their laptop the next morning, enabling keylogging, screen capture, and data collection. CrowdStrike's analysis suggests the China Ministry of State Security is behind OVERCAST PANDA.

Security tools such as EDR, MFA, and AI agent security were circumvented because the compromise occurred below the operating system and agent level. CrowdStrike disclosed that disabling external USB boot in UEFI, enforcing full-disk encryption with pre-boot authentication, and verifying Secure Boot are crucial defenses against such attacks. The group also targeted a U.S.-based media professional using similar methods in mid-2026.

CrowdStrike highlighted that while network-based attacks can scale, physical-access intrusions are more targeted. The report noted that executives attending international conferences should use travel-only devices lacking access to production systems or saved credentials. These older, less complex security controls, though inconvenient, are essential to close the vulnerability window exploited by OVERCAST PANDA.