The OFAC may begin sanctioning US nationals and institutions that help facilitate payments in a ransomware attack.