They get the patents in various ways. The common way is to buy it from a bankrupt company, though many companies who aren't bankrupt will sell off patents. A lot of them will buy company X, then create X LLC as a holding company for the patents to sort of trick people into thinking it is a real company.
Some trolls will make their own patents. Sometimes it is engineers who fancy themselves inventors or other times it is a patent attorney looking to make money. Though the latter is fairly rare.
There are several big "patent assertion companies" that do this on a large scale. They are very good at determining value of a patent, figuring out who to sue, etc. They have a team of lawyers on staff. These types of trolls usually go after big companies for big dollars. They'll definitely settle, but they aren't looking for 40k or something small.
Some are small time groups or even single people who just learned the system. A lot are former attorneys. These smaller ones are more likely to just seek a small payout. These ones are the most annoying because they often have zero case but are demanding such a low amount that its better to just pay, which of course incentivizes more patent exortion.
But there are a lot of smaller law firms that specialize in troll law suits who do most of the legal work. I'm not sure what the business model is like, if they work on contingency or not.
If the trolls are making their own patent, one way to "craft" your patents is continued applications. You claim a super broad claim early, and then continue to fight over it for years and years. If you win the broad claim, huge win. But even if you don't, you can sort of craft the claims to cover technology that has since gone mainstream. The continued applications get backdated to the original. This practice has been reigned in a bit by changes to law and regulation.
But I think the best way is to just pick up patents from a legit company that is selling them or is in bankruptcy. These companies will have patents that were cutting edge at the time. I also think it's the more morally defensible way to patent troll. You give R&D extra value and let companies take out loans backed by IP, because you are creating a market for IP. I'm sure more than a couple mature start ups have leveraged patent portfolios to borrow capital.
The trolls and their attorneys are typically more efficient than defense firms. Defense firms typically throw an army of lawyers at the case and it has diminishing returns. Also, the plaintiffs role just seems easier IMO.