The government agency hinted at possible additional sanctions for "financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response" that facilitated ransomware payments.