RangeFactory: Scalable Construction of Multi-Hop Cyber Ranges

2026-08-10

AI Summary

Existing approaches struggle to automatically construct and validate end-to-end multi-hop cyber attack-and-defense scenarios, hindering research into the persistent exploitation capabilities of large language model (LLM) agents across complete attack chains. This work proposes RangeFactory, a novel framework that formulates multi-hop range construction as a dependency resolution problem. By integrating real-world attack traces to extract dependencies, template-guided orchestration, and runtime dependency validation, RangeFactory enables the automatic, scalable generation of verifiable multi-hop attack paths from isolated vulnerability environments. Leveraging this framework, we introduce RangeBench—a benchmark comprising 1,148 instances spanning 287 distinct attack chains—and reveal that 24.5–47.0% of LLM agents fail to progress beyond initial footholds. We also release a dataset of 5,541 annotated multi-hop attack trajectories with execution outcomes.

Abstract

Real-world cyberattacks often require sustained progress across multiple hosts and network segments, making multi-hop cyber ranges essential infrastructure for studying and improving LLM agents' ability to sustain complete attack chains. Prior work has scaled isolated vulnerability tasks and constructed multi-host scenarios from manually specified vulnerability semantics. However, they are still unable to automatically orchestrate the growing supply of vulnerability environments into end-to-end validated multi-hop ranges. To this end, we present RangeFactory, an automated cyber-range orchestration framework that constructs multi-hop cyber ranges at scale from isolated vulnerability environments. RangeFactory formulates range construction as dependency resolution: it extracts dependency information from agents' actual attacks against real vulnerabilities, resolves known dependencies through template-guided orchestration, and uses end-to-end attack execution to validate runtime dependencies that emerge after composition. Using RangeFactory, we construct RangeBench with 1,148 validated range instances spanning 287 distinct attack chains and evaluate frontier attack agents across attack depth, network scale, and task information. Among runs that compromise the entry vulnerability, 24.5-47.0% still fail to complete the remaining attack path, revealing a substantial sustained-compromise gap between establishing an initial foothold and completing a multi-hop attack. RangeFactory further produces a corpus of 5,541 outcome-annotated multi-hop attack trajectories, providing execution data for attack-process analysis and future agent training.

Problem

• multi-hop cyber ranges
• automated orchestration
• vulnerability environments
• attack chains
• sustained compromise

Innovation

• cyber range orchestration
• multi-hop attack chains
• dependency resolution
• automated validation
• LLM agent evaluation