A hacking group operating out of China with possible state sponsorship has been spying on governments and companies across Southeast Asia—Cambodia likely included—for the past decade, according to U.S.-based Internet security firm FireEye.

In a new report, the firm said the hackers had been at work since 2005, focusing on targets with key political, economic and military information about the region — including an operation carried out during an Asean meeting in Phnom Penh in 2012.

FireEye said the hacking group, which it calls APT30, stands out from others like it traced back to China for its longevity—it is believed to be still be operating— and its geographic scope.

“Their missions focus on acquiring sensitive data from a variety of targets, which possibly include classified government networks and other networks inaccessible from a standard Internet connection,” according to the report, which said the group has gone after what should be more secure air-gapped networks well before other advanced hacking groups.

“Such a sustained, planned development effort, coupled with the group’s regional targets and missions, lead us to believe that this activity is state sponsored, most likely by the Chinese government,” it said.

FireEye said it confirmed APT30 targets in seven countries: India, Malaysia, Saudi Arabia, South Korea, Thailand, the U.S. and Vietnam. It says it found “likely” targets in 10 others, mostly in Southeast Asia, including Cambodia.

The security firm did not say that the Cambodian government was a target itself.