Apparently the warrant was served only after an discovering evidence from an unrelated (or semi-related?) arrest?
The article didn't specify if his ransomware worked, but I doubt it did if it was mostly GPT-generated. I guess the intention and confession is enough to make charges stick though. Wouldn't be surprised if whatever GPT service he used also flagged him as suspicious and led authorities to him.