Then it's a bad move for them since Bitcoin is not anonymous. It reminded me of those 2 Iranian hackers who was indicted by the US Department of Justice for the Samsam malware. The US authorities we're able to tracked and traced the specific Bitcoin addresses that's why the identifies have been revealed. For sure they're not being followed and every movement will be closely monitored and will be stop at all cost before they can exchange it to fiat.
I don't think that most of those who try to use crypto as ransom payment option or for whatever other illegal activity, know that the far majority of crypto currencies don't offer any form of actual anonymity.
It's an easy way for authorities to whoop their booties, which is quite funny, because it's usually the authorities having a hard time catching up on technological advancements.
I guess it's the media being largely responsible for making it look like Bitcoin is a safe haven tool for criminals. They are better off looking into GrinCoin and have that be a real world test to see how anonymous that coin really is.