IIRC REvil does not sell the malware to criminals, they give the malware to criminals but hold some control over the decryption keys needed for the ransom to ensure that they get a share of it.

I.e. it's truly an affiliate / revenue sharing system, not a sale of tools.

Ah, interesting. I guess that'd be the way to do it, though I wonder if they hold the payment keys themselves too, or if they get paid after the fact.