iPhone locked for ransom: how to recover if it's offline?
Contact Apple. Immediately.


This is probably a security breach of your friend's iCloud account. In order to lock your friend's iPhone, his/her iCloud password is required.
This could either mean that there is a security flaw within iCloud that is not known by Apple and has been exploited or that your friend might have leaked their credentials to a phishing scam.


You can contact Apple support right here:
https://getsupport.apple.com

Alternatively, because your friend's phone is being held for ransom, you might want to contact the local police and report a case.

You may want to try SvenS's answer and see if that disables the SIM lock, though I doubt it is the cause of the phone being locked.