"Every ransomware group needs to be designated by OFAC as a sanctioned entity in the absence of formal identity of those behind the group, making it illegal for all U.S.-connected companies to pay ransomware gangs," writes Nicholas Weaver: https://www.lawfaremedia.org/article/ofac-the-ransomware-gangs