Several torrent trackers have referal programs with VPN and seedbox providers. I wouldn't be surprised if there's a monetary channel between trackers and release groups also.
I really don't think these kinds of groups are spreading malware through releases, though. It'd be detected quickly so would only be possible as a one-time exit-scam kind of thing.
