These groups often sell ads to other cybercriminals, either for a fee or a share of the operations