Iru Threat Intelligence

@officiallyiru Security Research team's space for sharing intelligence and observations about what we see in the technology and cyber industries.

[Iru Threat Intelligence @iruthreatintel]

Shoutout to our Principal Security Researcher, @theevilbit , for the 56 vulnerabilities he submitted that put Iru on the board of the top 10 companies reporting CVEs in Apple.

[Huntress @HuntressLabs]

RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick).

We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵

[Iru Threat Intelligence @iruthreatintel]

This is a breath of fresh air amongst all the AI FUD.

While the AI risks are real - this is a great example of how it could be used for immense good. These vulnerabilities were already there regardless, so a lot of companies worst day may have just been averted.

[Iru Threat Intelligence @iruthreatintel]

Microsoft’s Oct 13 Patch Tuesday fixed a record ~1,413 CVEs, not including the 348 flaws fixed earlier in the month. That's more than all of 2025 combined for the platform.

There were nearly 40k CVEs were published in H1 2026.

Undoubtedly the result of AI.
https://t.co/mqRa4edYPH

[Csaba Fitzl @theevilbit]

✔️ It's a wrap! We are done with our very first 4 day version of our macOS Vulnerability Researcher training with @gergely_kalman

Lot of jaw dropping moments, sometimes even for us. 🙈

At the moment we don't know when we will do another 4️⃣ day again.

[Iru Threat Intelligence @iruthreatintel]

@GenThreatLabs Nice, we see it too:
ce1a847b63f2ab037f9eed0756b1330a582f8f84f0e813dc5e850b148e514d49
b41d79b743478105603242d9604162b99efb06952a8bb852d3c3473827522ead
484e1e98593cf784dbbfd94b0b42ff91d9321a8e979aadc7f6e6735060c99151
338a8e220034ae548abdaece10f8bb0d4038cf8e3e4095dde2f2e2d5db329cb9

[Gen Threat Labs @GenThreatLabs]

We discovered a new macOS #botnet calling itself #Nyx.

The Go-based bot combines LaunchAgent persistence, encrypted C2 communications with remote command execution, stealing, payload delivery, host/cloud reconnaissance and multiple DDoS-related modules.

IoCs:
Sample SHA-256: b41d79b743478105603242d9604162b99efb06952a8bb852d3c3473827522ead

Plist dropped SHA-256: 97e520dbef727638f1112345c86318c3ec081b51bd101c4fc165c3595b0bf9ec

[Iru Threat Intelligence @iruthreatintel]

Iru TI finished off September strong!

Cristian posted a blog breaking down PamStealer and Csaba put in overtime applying pressure to Apple.

Excited for what's next to come 👀

https://t.co/8K7wZOx1Ep
https://t.co/xk91llpUyY

[Csaba Fitzl @theevilbit]

So apparently according to Apple:
MITMing an encrypted communication to a service on the LAN and sniffing clear text password is... fine.

"We’re unable to identify a security issue in your report."

🤷‍♂️

[Iru Threat Intelligence @iruthreatintel]

Meet @iruthreatintel! Iru's Security Research team brings experience from government, military, and private sector to one place. We are excited to share observations on what's moving across the technology and cyber industries. https://t.co/dmeCuFEEwG