Treasury is signaling that organizations that pay ransomware could be at risk of prosecution for running afoul of US laws if the person or organization they’re paying is on a sanctions list.