US recovers most of ransom paid after Colonial Pipeline hack