We can logically assume (yes, this is not proof) that the ransom was in BTC, because it's the hardest to track and the easiest to launder, especially by coin mixing services and through unregulated exchanges, neither of which require user IDs.

What would the hackers do with the funds? Try to get them, at the end :)