RangeFactory: Scalable Construction of Multi-Hop Cyber Ranges
2026-08-10 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors created RangeFactory, a tool that automatically builds complex cyberattack practice environments by linking smaller, isolated vulnerabilities together. This helps test how well AI agents can carry out complete multi-step hacking attempts across networks. They used RangeFactory to make many attack scenarios and found that even when AI agents manage to start an attack, they often fail to finish it. The tool also collects detailed data from these attacks to help improve future training and analysis.
cyber rangemulti-hop attackvulnerabilitydependency resolutionattack chainLLM agentsattack trajectoryorchestration framework
Authors
Hanlin Jiang, Puyi Wang, Jiandong Jin, Shaofei Li, Zhan Shen, Pengli Wang, Ziming Wang, Yifeng Cai, Ning Jia, Yuxin Ren, Peng Jiang, Yao Guo, Ding Li
Abstract
Real-world cyberattacks often require sustained progress across multiple hosts and network segments, making multi-hop cyber ranges essential infrastructure for studying and improving LLM agents' ability to sustain complete attack chains. Prior work has scaled isolated vulnerability tasks and constructed multi-host scenarios from manually specified vulnerability semantics. However, they are still unable to automatically orchestrate the growing supply of vulnerability environments into end-to-end validated multi-hop ranges. To this end, we present RangeFactory, an automated cyber-range orchestration framework that constructs multi-hop cyber ranges at scale from isolated vulnerability environments. RangeFactory formulates range construction as dependency resolution: it extracts dependency information from agents' actual attacks against real vulnerabilities, resolves known dependencies through template-guided orchestration, and uses end-to-end attack execution to validate runtime dependencies that emerge after composition. Using RangeFactory, we construct RangeBench with 1,148 validated range instances spanning 287 distinct attack chains and evaluate frontier attack agents across attack depth, network scale, and task information. Among runs that compromise the entry vulnerability, 24.5-47.0% still fail to complete the remaining attack path, revealing a substantial sustained-compromise gap between establishing an initial foothold and completing a multi-hop attack. RangeFactory further produces a corpus of 5,541 outcome-annotated multi-hop attack trajectories, providing execution data for attack-process analysis and future agent training.