Ransomware Without Downtime: The Shift to Data Exfiltration and Exposure

David Shaw explains that ransomware leverage is shifting from encrypting systems to stealing data and threatening public exposure, using Galaxy Warden’s report that Canadian immersive media company PHI Studio appeared on Nova Ransomware’s leak site on July 17 after data was exfiltrated. He argues this model particularly endangers creative and IP-heavy businesses because unreleased work, client contracts, and other confidential assets can be exposed without operational downtime. Shaw connects the threat to CISA’s Known Exploited Vulnerabilities Catalog, highlighting actively exploited flaws in edge-facing systems like remote access platforms, identity infrastructure (e.g., ADFS), collaboration tools (e.g., SharePoint), and critical apps. He stresses detection and monitoring (EDR and network visibility), tested response readiness, and insurance realities as carriers remove silent cyber coverage and scrutinize MFA and controls. He recommends executives ask about KEV patch status, phishing-resistant MFA compliance, and whether a 48-hour intruder would be detected.

00:00 Silent Ransomware Shift
01:22 Meet The Rook
02:30 PHI Studio Case Breakdown
03:11 Why Exposure Hurts Most
04:28 CISA KEV And The Door
06:07 From Downtime To Liability
06:59 Detecting Exfiltration With EDR
08:44 Vulnerabilities To Full Breach Chain
09:52 Insurance And Control Requirements
11:24 Three Questions To Ask Now
14:25 Wrap Up And Next Steps

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

Sources: