Where is malware stored online before it is downloaded?

Where can malware be stored online?

I’ve looked at several websites about malware infection and it mentions things like drive-by downloads and exploit kits, but I can’t see where the actual .exe, macro etc files are stored in the first place to be downloaded onto a user’s device. Are they placed on servers online and linked to?