Really good Sophos report on data from IR cases they deal with (mostly going to be crimeware due to their customer base, i.e. real operationally disruptive threat actors rather than pretend operation threats aka APTs).

You might think 'threat actors are sat in hoodies hacking the Matrix using […]