You need a cell-based organization, with the additional twist that recruitment must happen cross-cell-wise.
That is, the members of the Blackwater Lodge meet and discuss whether to admit mr. John Smith. They all need to know John Smith in order to pass a judgment, so John Smith's identity is compromised. In time, higher-ups in the Blackwater Lodge would come to know the identities of almost every other member younger than them, even if they wore black hoods during meetings.
If they decide that John Smith would make an acceptable adept, they supply him with the required passwords and tokens, and send him on to the Greyfriars Lodge. The Blackwater Lodge does not know where the Greyfriars convene, or when, and no one in the Greyfriars know who John Smith is - they only know that he's been accepted by another lodge of the same cult. John Smith knows nothing about the Blackwaters who have interviewed him, so nobody can betray anybody else. Someone in Blackwater could rat John Smith out, but all they'd be able to say is that he belongs to the cult. They wouldn't be able to say where he goes to perform the rites, or when, or even whether he's still an active member or not.
At the same time John Smith would know one or two Blackwaters, but again he would know nothing else. What you don't know, you can't betray.
steganographic communication (as per @Jay's comment)
So we have several lodges and they need to communicate secretly, and more than that, they don't want to make it look like someone is communicating at all. They need to set up the equivalent of a numbers station: the one talking won't know who and where and whether anyone is listening, and the one listening won't be able to see who is talking.
- First they find some channel. This can be anywhere communication noise can be found; for example a Youtube channel's comments.
- Then they must generate a largish set of symbols (this can be done automatically) which would not be deemed out of place on that channel. This could be the combination of some features of a user's name, avatar, and words in a message.
- Finally they need to set up an automatic monitor that will, say, continuously download all the comments from several Youtube channels, and see whether any of those can be successfully decoded. Typos, word choices, emoticons, lolz etc. can all be used to encode bits.
A single message could then be broken in eight or ten comments, and e.g. a Polygen grammar could be used to generate not too incredible ones.
The necessary nicknames would then be created automatically and used to send the comments for everyone to read.
From the outside, you would see comments to a lolcat video
- [Emily84] aww..... what a cutie pie.... I wish I had one ;))) <3 <3!
- [EvilHaxx0r] OMG r u seriouse? I mean look at that lol
- [JustinTheBore] lolcats for teh winnnnn ;-D
- [Edzorg] RUN BABY RUN
- [EvilHaxx0r] run what? lol what a retard XXP
but once decoded you would get something like "REQUEST FOR MEETING, NEW MEMBER FOR GREYFRIARS". Even if someone monitored the whole Internet, they would only see some random guy blathering on some channel through a Tor node (special once-only keywords could be used by members in a hurry and without access to the full "comment encoding" system. Enter a Starbucks, look at some videos, leave two or three comments).
preventing higher-up treason (@cmaster's comment)
Smith may know only little, but he does know anything that's communicated to him. More specifically, at some point he may be in a position where he is interviewing new adepts. If smith is subverted
This is a real problem, since by design the interviewers and the new adepts have only the loosest of connections. Specifically, the new adept can't compromise the interviewers, which means that the interviewer can compromise the new adepts with very little exposure for himself.
So the interviewer is in a position where, if he ever needs, he can plead "Wait! Wait! I did embezzle that money! But if I get a reduced sentence, I can make it worth your while!". He can concoct a story where he learned by chance of the sect, and only had very little proof except his own hunches.
So the evaluators must not be able to conclusively know the evaluees - the one member that introduces the new adept will have to sanitize all documentation, and the evaluators must not know the new adept's identity. This both places a very large burden of investigation on the introducer, and allows him to plant an infiltrator in another lodge. By only allowing a limited number of new adepts per introducer, and limiting the role to the very high-up in the hierarchy, we can reduce this vulnerability.
Then, the introducer must have much more to lose than any number of his protegees; he might for example be the one in charge of victim procurement. This fact must also be very well known to the lower ranks, to ensure it can't be overlooked or denied. One new induction allowed for every ten rituals performed, and now whoever knows for certain (and can betray) the identities of X members is thereby also confessing to 10X counts of first degree multiply aggravated murder ("With planning involved... after the act of kidnapping... after the act of rape").