This undated presentation from the NSA’s Expeditionary Access Operations discusses how malware techniques are used in the field: see the Intercept article The NSA Leak is Real, Snowden Documents Confirm, 19 August 2016.
This 2011 Wiki page details aspects of GCHQ’s DAPINO GAMMA operation against mobile SIM manufacturer Gemalto: see the Intercept article The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle, 19 February 2015.
This 20 April 2004 memo, originally published in the internal NSA newsletter SIDToday and written by the agency’s DEA Account Manager”, discusses NSA cooperaiton with the Drug Enforcement Administration (DEA): see the Intercept article Data Pirates of the Caribbean: The NSA Is Recording Every Cell Phone Call in the Bahamas, 19 May 2014.
This NSA document from 10 September 2010 details operations against foreign embassies, concluding with a glossary of tools and tactics. Earlier versions of this docoument that only contained some of the operations conducted were published in l’Espresso on 5 December 2013 and in Le Monde on 21 October 2013: see the book No Place to Hide, 13 May 2014.