Do government sanctions against ransomware groups work?