Your EDR didn’t catch it because it wasn’t malware.

That’s SystemBC for you. Ransomware crews love it because it’s just a SOCKS5 proxy — not inherently evil, just used for evil. Your firewall…