> I mean how can a DDOS generate revenue?

You rent out the capacity. Few hours of N Gbps flooding, courtesy of 20-30 thousand compromised home systems and IoT shitware units: tens to maybe low hundreds of dollars.

Now assume that's only a couple of percent of the total capacity under the botnet's control. Also, there are 24 hours in a day - once the current blaster's rental time expires, you have another one lined up already.

I recall seeing numbers in some fairly old Krebs article, but can't find it right now.