I've grudgingly come around to the notion that there is only one way out of the ransomware problem: Make paying a ransom illegal. This is not very different from laws that make it illegal for US companies to pay bribes to foreign officials.
I really don't see any other way out of this mess. Yes, some victims will unfortunately ignore any laws that say they can't pay, but enforcement probably will not be hard.
What will be difficult are the situations where peoples' lives are at stake in ransomware situations. This sounds callous, but we can't afford to take the short view here anymore, and our other alternatives aren't great either.
I'm quite certain this is an unpopular view, but we have already seen the cost of doing nothing. At least in the interests of congruity for our financial sanctions vs Russia, we should probably make this change sooner rather than later.
More effective - and solving more problems - would be to outlaw cybercoin schemes entirely. They're the enablers of ransomware and many other scams, and add zero real value. Once the bad guys no longer have a safe way to transfer large sums, the activity becomes far riskier and less profitable, and they'll target regimes where the funny money is still legal. I am frankly surprised it hasn't already happened given the abuse we see daily.
