Intelligence does not get funded the same way that everything else does. It has a history of being self-funding if necessary. This could easily all be funded off the books via a third department that simply straight-up acts as a conventional ransomware attacker. I would be deeply unsurprised most ransomware payouts ultimately land in some intelligence budget for some country somewhere.
Rumors say that North Korea is behind some ransomware.
Yup. For example, the US government recently sold $215M in BTC originally seized from Silk Road operators[1].