I'm wondering this too. I used to work at a DSP and we had to deal with a lot of clickfraud. Typically it took the form of: a shady publisher which has somewhat legitimate content and has a relationship with one or more SSPs. Then the publisher goes to "traffic growth" sites like cpmbux.com, and purchases fake traffic. Those fake traffic sites own botnets which they leverage to generate the fake impressions on those publisher's websites. Because there's this separation between the two parties, even if the publisher gets shut down by the SSP for engaging in clickfraud (there's still plausible deniability), the fake traffic site can continue marketing themselves to other not so by-the-book publishers.
I'm not sure if it's a similar arrangement here. The linked report makes it sound like they own the publisher sites too, but it's hard for me to fathom how they could maintain "legitimate" relationships with SSPs when they're funnelling out millions of dollars per day. It goes without saying that it's much harder to fake your way through the financial system.