IIRC feds have gone against companies using some third-party consultants to pay a ransom that eventually went to a entity on US sanctions list like Iran or North Korea. Or at least they have loudly threatened to do so.

Also, there have been some enforcement actions on intermediaries for facilitating such payments - e.g. https://home.treasury.gov/news/press-releases/jy0471