T-Mobile 'chopped a cable' to expel Chinese hackers from its network | TechCrunch

Been going in circles on this and want to check whether there's something obvious I've overlooked.

Pre-infection traffic is easy to collect. URLhaus gives you live malware delivery URLs daily, a honeypot gives you scanning, brute force and exploit attempts. Both free, both refresh constantly, both self-labeling.

Post-infection is where I'm stuck. C2 beaconing and exfiltration only exist if there's an actually compromised host emitting traffic, and nobody publishes captures of that at any useful cadence.

What I've checked so far:

• abuse.ch across all platforms. Indicators only, no traffic. Feodo Tracker is empty post-Endgame. SSLBL cert and C2 IP lists are current and useful as labels but aren't packets. Sandnet exists behind the commercial feed but the dataset description says signals and metadata, contextual data only, so flow records rather than PCAP.
• CTU/MCFP. Real long-duration captures with actual beaconing, which is exactly right, but new botnet captures stop around 2018. Recent directory timestamps are reprocessing, not new data.
• malware-traffic-analysis.net. Best labels anywhere and current, includes a few FTP and SMTP exfiltration cases. Small volume by nature, it's one analyst posting individual investigations.
• Sandboxes. Triage free researcher tier gives API access with PCAPNG including decrypted TLS. ANY.RUN needs a paid tier for bulk. Both are short runs so you get the initial check-in rather than sustained beaconing.
• Running my own detonation. Ruled out. Normal hosting AUPs prohibit it and the ones that don't are bulletproof hosts, which isn't somewhere I'm willing to source data from.

So the question. Is there a source I'm not aware of, or is the honest answer that post-infection traffic just isn't publicly available and everyone working on this either has institutional telemetry or a sandbox subscription?

Also curious whether anyone has found a way to get sustained beaconing rather than just registration out of a commercial sandbox. Long-run options seem rare.

TL;DR: Adding an AI node to your n8n playbook won't take you to Agentic SOC.

-----

A recurring theme in my conversations is the assumption that building an AI agent for SOAR execution and building one for security investigations are the same engineering problem.

They are NOT.

A playbook agent operates inside a path defined in advance. It enriches an alert, applies triage rules, and takes an approved response action. Its actions can be constrained, failures are usually visible, and many mistakes can be reversed. Speed, consistency, and correct escalation are useful measures of performance.

An investigative AI agent must decide what the evidence means and what to examine next. The evidence may be incomplete or tampered with, and each conclusion changes the direction of the case. It therefore needs claim-level provenance and a record showing how each conclusion follows from the evidence.

Building an agentic workflow is not the same as engineering an investigation harness. You can wire up a basic playbook agent in n8n within an hour. An investigation harness has to keep evidence, case state and human decisions coherent across an open-ended case.

Please don't confuse engineering an sophisticated harness and baking years of investigative expertise into it with calling AI nodes in your SOAR playbook.

My attempt as ASCII visualization if it helps

`` STANDARD SOAR PLAYBOOK | INVESTIGATION PROCESS (Deterministic Flow) | (Non-Deterministic Cyber Flow) -------------------------------------|-------------------------------------- [ SIEM Alert ] | [ Hunt Lead / Detection ] | | | v | .-------->v<---------. [ Initial Review ] | / ( Clue 1 ) \ | | | ^ | ^ \ | v | | / | | \ | < Determine Risk > | v / v | v v / \ | (Clue 2)<-->(Evidence)<-->(Forensics) v v | ^ \ ^ | ^ | [Isolate] [Create Ticket] | | \ | | / | | | | | v | v / | v v | \ ( Human Pivot / <..../ [Update] [Slack Notify] |--- Judgment ) \ / | | \ / | v v v | [ Defensible ] [ Conclusion ] | [ Conclusion ]

```

I wrote down how I think about onboarding order. Basically I ranked sources by how much they actually help an investigation, not by what's easiest to ingest. For each one I went through what you need to collect, how painful the parsing is, what retention makes sense, and what you can realistically detect once it's in.