OVERCAST PANDA Uses Evil Maid Attack with USB Boot in Hotel Rooms

On a spring evening in 2026, while executives attending an agricultural industry conference on Hainan Island dined away from their hotel rooms, intruders entered two separate rooms, booted the executives’ laptops from a USB stick, wrote a backdoor called FlowCloud directly to the machines’ storage, and then left. There was no phishing email, no stolen credential, and no network intrusion. The laptops sat compromised until the next morning, when the executives powered them on and the malware activated. The group behind the operation, tracked by CrowdStrike as OVERCAST PANDA, is a Chinese state-linked hacking unit that, according to the company’s 2026 Threat Hunting Report, exploited a physical-access vector that most security tools are not designed to detect.

Summary

Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations, told VentureBeat that the first room was entered around 8:00 p.m. local time and the second by 9:57 p.m. The backdoor, FlowCloud, was written to disk before the operating system even loaded. The attackers rebooted the machines and walked away. It was only after the next boot, when the Falcon sensor initialized, that the malware was detected. But by then, the implant and its trigger were already on the device.

FlowCloud is not new. Proofpoint documented it in 2020, delivered via phishing to U.S. utilities. NTT Security’s SOC has tracked USB-delivered infections at overseas branches of Japanese organizations since early 2022. What is novel, Meyers said, is the combination of physical hotel-room entry by a state intelligence service with malware deployment — specifically, booting the target machine from USB rather than relying on a user to plug in a dropped drive.

Security researchers have long called this kind of physical-access tampering an “evil maid attack,” a term Joanna Rutkowska coined in 2009 when she demonstrated a bootable USB stick attack against TrueCrypt. But such attacks are rare across the 290 named adversaries CrowdStrike tracks, Meyers noted. The version used by MUSTANG PANDA, another Chinese group, depends on a victim plugging in a dropped USB stick. OVERCAST PANDA’s approach bypasses that user-dependent step entirely.

What is an evil maid attack and how does it bypass modern endpoint security?

An evil maid attack is a physical-access technique where an attacker gains brief, unsupervised access to a device — typically a laptop left unattended in a hotel room — and modifies the boot process or storage to install malware. The attack works because the compromise occurs below the operating system, before the endpoint detection and response (EDR) agent loads. MFA waits for a login attempt, phishing training for an email, and AI agent security for an agent to secure. The initial write of the backdoor completes while the laptop is powered off or in a low-power state, then the malware triggers after the OS boots and the EDR sensor starts. The gap is the window between the USB write and the next boot — the hours the laptop sits compromised and undetected.

Why existing security tools missed the intrusions

EDR requires the operating system to be loaded and the agent running. MFA waits for a login attempt. Phishing training cannot help if no email is sent. AI agent security secures agents, but the initial compromise happened below all of them. The OVERCAST PANDA operation completed the infection below the running OS, below the EDR agent, below the authentication stack. Falcon caught FlowCloud once its process started after boot, but by then the implant and its trigger were already on disk.

Meyers described the attack as a solvable problem, but one that most organizations have not addressed because the fix is inconvenient. “Hotel entry is a very common thing,” he said. “Talk to any corporate physical security person. They’re generally aware of hotel entry, but I think what is unique is the combination of hotel entry with deployment of malware.”

Meyers assesses that China’s Ministry of State Security (MSS) sits behind OVERCAST PANDA. The people entering the rooms are either officers of the MSS or the Ministry of Public Security, or hotel housekeeping staff that the services have bribed or compelled. A separate mid-2026 intrusion targeted a U.S.-based media professional using the same tradecraft, according to the report. Targeting an agricultural conference aligns with collection priorities Meyers tied to China’s five-year plans.

Fal.Con 2026 announcements: runtime security for a new era, but the same old gap

At Fal.Con 2026, CrowdStrike and Nvidia CEO Jensen Huang unveiled SafeMind, an agentic cybersecurity system built on Nvidia Nemotron open models and CrowdStrike’s threat data. The company also launched Falcon Guardian, a runtime security layer for AI agents on the endpoint, and AI Gateway, a hosted service shipping in September. Meyers told the Fal.Con audience that 7,400 CVEs were registered in June 2026 — a 96% increase over June 2025 — and that CrowdStrike submitted 2,400 of them via responsible disclosure, roughly 30% of all CVEs registered that month.

These products address real threats. AI agent-triggered detection leads grew at 2.5 times the rate of human-triggered leads, by OverWatch’s count. Cloud-conscious eCrime activity surged 171% over the reporting period. Vishing intrusions doubled in the first half of 2026 compared to the second half of 2025, with the eCrime group SNARKY SPIDER moving from account takeover to data exfiltration in under five minutes after compromising SSO-integrated SaaS applications.

Every one of those threats is network-based. All assume a running OS, an active user session, or a live cloud workload. The OVERCAST PANDA campaign exploited a gap that runtime security does not cover.

The controls that stop this are firmware and policy

“It’s a solvable problem,” Meyers said. “It’s just an inconvenient solution, which means that a lot of people don’t do it.”

CrowdStrike has shipped firmware attack detection and BIOS settings auditing through the Falcon sensor since May 2019, including a Dell SafeBIOS integration that surfaces BIOS verification telemetry in the Falcon console. The ability to audit security-related BIOS settings on the laptops executives carry has sat inside the platform for seven years. Pointing it at travel devices is a decision, not a product gap.

The controls that would have blunted the OVERCAST PANDA campaign are old and cheap, and each does a different job:

Disabling external boot in UEFI removes the USB boot vector.
A BIOS administrator password keeps the boot order locked.
Pre-boot authentication (PBA) — such as a BitLocker PIN or USB key — ensures that even if a foreign boot environment loads, the encrypted volume remains unreadable until a human supplies the PIN or key.
Firmware monitoring detects tampering after the fact.

OVERCAST PANDA wrote a backdoor and its post-boot trigger to the Windows volume, meaning the operators had write access to it. That points to machines that were either unencrypted or protected by a configuration the operators defeated. BitLocker in a TPM-only configuration is a documented weak point against physical access. SCRT researchers pulled the volume master key off the LPC bus with a $49 FPGA module in 2021, and Dolos Group did the same over SPI that year. Pre-boot authentication with a PIN or USB key forces a human step before storage becomes readable.

Secure Boot, when enabled with a current revocation list, validates signatures on boot components and blocks most unauthorized bootloaders. But it leaves external media bootable, and signed shims can still carry a bypass. ESET published findings on 11 legacy Microsoft-signed UEFI shims in July 2026 that let untrusted code run at boot on any machine trusting Microsoft’s third-party certificate. Microsoft revoked them in its June 9, 2026 DBX update, so any laptop that skipped that update still trusts them.

Lock the boot order at the UEFI level, disable one-time boot menus, and set a BIOS administrator password that covers both the setup utility and any boot-override key. Meyers’ read is that a lot of these settings go unchecked because the fix is inconvenient.

Why scale wins the priority fight

Intrusions tracked by CrowdStrike OverWatch grew about 4% over the reporting period, after a 27% rise the year before — a plateau attributed to a shift toward more complex, resource-intensive campaigns. The OVERCAST PANDA hotel room operation is the example.

Meyers was asked to weigh the hotel room campaign against the REVENANT SPIDER case he had shown on the Fal.Con stage — an eCrime group using AI to compromise 17 victims with custom web shells in 48 minutes. He picked REVENANT SPIDER as the more concerning threat for the average enterprise. “You can’t intrude on hotel rooms at scale,” he said. “You can’t intrude on physical devices at scale. And even then, it’s just one device.” The person in the room is the target, and the intrusion rarely pivots further. “REVENANT SPIDER, they’re moving at that speed and they’re using AI across the board, and that’s a whole other threat, and I think that’s more concerning for the average enterprise.”

Network-speed, AI-powered intrusions scale. Physical-access tradecraft does not. Security budgets follow the threat that hits the most machines. The threat that is hardest to detect on one machine gets what is left.

But the executives who attended an agricultural conference in China this spring were the specific targets of a state intelligence service, one that chose the slow, unscalable method precisely because it works where network-based attacks fail.

The conference itself is the threat model

Executives at conferences are the campaign’s targets, and runtime security starts only once the machine boots. The vendors filling the Las Vegas show floor this week were selling that same runtime protection to attendees whose own laptops carry the identical gap.

Organizational fracture is the real problem. Falcon Guardian ships to one team, and BIOS configuration on travel laptops belongs to another. The Agentic IdP rolls out under identity governance while the decision about whether executives carry production-access machines to international conferences sits with a different group. And the budget line that funds cloud-threat defense has nothing to do with travel-device policies.

Meyers has lived both sides. “I’ve talked to companies where they’re like, we’re having a board meeting in Shanghai, and I’m like, why would you do that?”

What security leaders need to do before the next trip

Audit every executive laptop for USB boot status. If the device can be booted from USB right now, it has the same gap OVERCAST PANDA exploited this spring. The steps below cover Windows laptops, the platform FlowCloud targets.

Enforce full-disk encryption with pre-boot authentication. BitLocker in a TPM-only configuration is a documented weak point against physical access. Pre-boot authentication with a PIN or USB key forces a human step before storage becomes readable.
Verify Secure Boot is enabled and the revocation list is current. Secure Boot validates signatures on boot components and blocks most unauthorized bootloaders, but it leaves external media bootable and signed shims can still carry a bypass. Ensure the June 9, 2026 DBX update is applied.
Lock the boot order at the UEFI level, disable one-time boot menus, and set a BIOS administrator password. This prevents an attacker from simply hitting a function key at boot and selecting the USB drive.
Issue travel-only devices for international conferences with no access to production systems, no saved credentials for internal tools, and no persistent VPN configuration.

Meyers’ advice: “Don’t bring anything with you that you’re not comfortable with handing over to a foreign intelligence service.” He used temporary laptops and email accounts on overseas trips while at CrowdStrike, wiping the device when he returned. The exposure starts at customs. Officials can seize a device and compel a login. “They have master keys to that stuff,” was his verdict on hotel safes.

“If they can get their hands on it, they can own it,” Meyers put it, citing an old DEF CON adage. Falcon catches FlowCloud only after boot — the exposure is the hours between the USB write and the next login, while the laptop sits closed and compromised. “It’s cheap to buy a couple of laptops and a couple of phones,” Meyers said. The controls that close that window are a handful of firmware settings and a spare laptop. The question is whether anyone has deployed them.