(Bloomberg) — Hackers working for Iran have targeted at least 50 companies and government organizations, including commercial airlines, looking for vulnerabilities that could be used in physical attacks, cyber-security firm Cylance Inc. said today.

The hackers infiltrated the computer systems of carriers and their contractors in Pakistan, the United Arab Emirates and South Korea, the Irvine, California-based firm said in a report outlining the results of a two-year investigation. They broke into the computers of suppliers responsible for aircraft maintenance, cargo loading and refueling, according to the report and Cylance analysts, and stole credentials that could be used to impersonate workers.

In the U.S., computers belonging to chemical and energy companies, defense contractors, universities and transportation providers were hacked in what Cylance dubbed Operation Cleaver. The report said the Iranian group is the same one that breached the U.S. Navy's unclassified computer system in September 2013.