Threat actors may have been duking it out for control of the compromised devices, first using a 2018 RCE, then password-protecting a new vulnerability.
Apple Patches 3 More Zero-Days Under Active Attack
-
One of the bugs, which affects macOS as well as older versions of iPhones, could allow an attacker to execute arbitrary code with kernel privileges.
https://threatpost.com/apple-patches-zero-days-attack/174988/