Ransomware Attack Bypasses EDR with BYOI Technique

**Executive summary:** Researchers uncovered a "Bring Your Own Installer" technique that abuses SentinelOne's agent upgrade process—killing msiexec.exe mid-install—to take hosts offline in the SentinelOne console and permit deployment of Babuk ransomware; SentinelOne issued mitigation guidance to enable "Online Authorization," but many environments remained vulnerable.