Detailed TTPs used in an escalating threat environment are not generally discussed in open source documents.

I previously posted a link to an open source MCM paper published by industry folks in another thread, but is more appropriate here:

https://zenodo.org/record/2530761#.Xs-eaGnTXqv

Qinetiq & BMT published a paper a couple of years ago on this subject that you might find relevant.

The conference proceedings from 2018 are here https://zenodo.org/record/2530761#.XsVyf2nTXqu