Sophos says the groups’ activity, which it believes was overseen by China’s Ministry of State Security, stopped in August of that year.

But the updated report says not only has the activity resumed, using a previously undocumented keylogger, the attacks have spread, including hitting two non-governmental public service organizations with what Sophos says have government-related roles, as well as other targets in Southeast Asia.

“It’s unlikely this threat group is only pursing the victims we’ve seen,” Chester Wisniewski, Sophos’ global field CTO, said in an interview. “We’ve only got visibility into certain organizations because they’re our clients, so we’re hoping by sharing this information, our competitors that may be protecting similar entities in the region can use the information we have to perhaps identify more activity and maybe add their information to paint a more complete picture.”