Huntress: https://www.huntress.com/blog/analyzing-initial-access-across-todays-business-environment
Thorough analysis of initial access and the distribution of various techniques. Exploitation of 0days, contrary to reporting is not an especially common technique but using stolen creds and logging in, however, is.
Good read for sure and certainly helps with prioritization of defensive countermeasures.