3ve was based on a complex system of three separate but intertwined botnet systems, all of which did roughly the same thing. As with Methbot, the fraud operators had access to huge amounts of infected devices which they could control remotely to open browsers to visit their spoofed sites and then channel those bots through them.
The practice of clicking on ads from a user’s device without their knowledge is, today, pretty old news. But at the time this was cutting-edge stuff and incredibly tricky to check or block.
In fact, 3ve leveraged other botnets in operation at the time, including Kovter and Boaxxe (aka Miuref). These could be used to source those valuable IP addresses used to mask their activity or to channel those high-volume bots.