A rural electric utility company, a children’s hospital, and others are among the sanctions. The suspected attackers and their firms