The Office of Foreign Assets Control says anyone facilitating ransomware payments to groups under US sanctions can face civil penalties.