The world has seen several surges of successful high-profile ransomware attacks since early 2020. In common beliefs, ransom attacks are straightforward hacking activities. However, there are more beyond the simple step of data encryption. This research presents the audience a close-up look into a ransom attack against a Singapore financial institute caused by PulseVPN vulnerability. It examines REvil’s delicate operation models under its raw hammer style power exhibition. It further surveys the underground eco-system which supports REvil’s success.