There's definitely a hierarchy to it. Any particular group may not necessarily develop or own the software or infrastructure they're using. You can probably liken it to drug markets, where there are some top-level central players and many tiers below that make up the whole supply and distribution chain. (And potentially, the absolute top-level / "The Commission" may be certain elements of certain nations' governments, in some cases, or at least closely associated with them, which further complicates matters.)

You might find this 2020 interview with a ransomware operator interesting: https://talos-intelligence-site.s3.amazonaws.com/production/...

Not much capital is needed though and the affiliate and licensing model is better, which also just means an address is hardcoded that splits payment, or a server controls the private key (or master private key for infinite unique address creation) to addresses and automatically splits received payments to the RaaS service

I get that was supposed to be a joke, its exactly the same or even more streamlined than the licit economy. There is no major distinction except the kinds of “risk factors” one might list.