Serious sanctions and legal consequences may be slowing ransomware groups down, but it's still unclear if this is a permanent shift.