USB-based hotel room intrusion linked to Chinese state hackers, CrowdStrike says
Chinese state-linked hackers infiltrated executive laptops at an agricultural conference by physically entering hotel rooms and booting devices from USB sticks while the owners were away. CrowdStrike identified the group as OVERCAST PANDA and noted that a security fix existed but was not applied. The breach occurred on Hainan Island this spring, with intruders entering rooms around 8 p.m. and 9:57 p.m. local time.
The attack relied on physical access rather than remote exploits, with intruders entering hotel rooms at two separate times during the evening. By booting executive laptops from USB devices, the hackers bypassed typical network defenses, gaining direct control of the machines. CrowdStrike attributed the operation to OVERCAST PANDA, a group tied to Chinese state interests. Notably, a patch addressing the vulnerability was available but had not been deployed on the affected systems, leaving the devices exposed. The conference, held on Hainan Island this spring, drew senior executives whose laptops contained sensitive data, making them high-value targets for espionage.
This incident highlights how even sophisticated cybersecurity measures can be undermined by physical security gaps. Business travelers and conference organizers may need to reassess hotel room access controls and device encryption practices. The fact that a known fix went unapplied suggests that patch management remains a weak link for many organizations. Such intrusions could erode trust in corporate travel security, prompting stricter policies for device handling and room security. However, the broader impact may be limited to high-profile targets, though it underscores the persistent threat from state-sponsored actors.