Here is basic outline: start with existing virus that has strong desired traits and known strains that mutated to resist antibiotics. Example traits include spread model, incubation length, and lethality.

Establish or take over a remote site that has little to no interaction with outside world. Remote corners of Africa and South America come to mind, there are plenty of secret illicit drug farms in the jungle. [0]

Infect the sample population with target disease, give it a few days, and slowly start to drip in countermeasures gradually increasing the dose. Idea is similar to how diseases we get anti-biotic resistant strains in the first place - people do not complete the full course of drugs and are left with weakened, but also with a strong selective pressure that benefits against strains that have resistance against drugs person was treated with.

Take samples when you have desired output and continue with new group of people.

To account for people who are immune to a particular disease repeat this with a different disease, potentially one that can advantage of weakened immune system.

Once target disease(s) are ready distribute them in population centers.

Now there are few obvious cons I can think of:

1. If secret about this leaks out, military reaction form rest of the world would be swift.

2. Hiding something like this is hard, and get's exponentially harder as group grows.

3. There is a strong chance something like this was tried already and failed. Possibly because I am grossly underestimating immune system.

4. To keep initial phase of developing secret initial group must be small, to spread it effectively dissemination group must be large.

[0] Another potential avenue is partnership with a supportive state such as Syria, North Korea, or Iran.

[0] not a full hazmat, just some protective wear over mouth, nose, ears, and eyes.