RangeFactory: Scalable Construction of Multi-Hop Cyber Ranges

RangeFactory: Scalable Construction of Multi-Hop Cyber Ranges

Abstract

Real-world cyberattacks often require sustained progress across multiple hosts and network segments, making multi-hop cyber ranges essential infrastructure for studying and improving LLM agents’ ability to sustain complete attack chains. Prior work has scaled isolated vulnerability tasks and constructed multi-host scenarios from manually specified vulnerability semantics. However, they are still unable to automatically orchestrate the growing supply of vulnerability environments into end-to-end validated multi-hop ranges. To this end, we present RangeFactory, an automated cyber-range orchestration framework that constructs multi-hop cyber ranges at scale from isolated vulnerability environments. RangeFactory formulates range construction as dependency resolution: it extracts dependency information from agents’ actual attacks against real vulnerabilities, resolves known dependencies through template-guided orchestration, and uses end-to-end attack execution to validate runtime dependencies that emerge after composition. Using RangeFactory, we construct RangeBench with 1,148 validated range instances spanning 287 distinct attack chains and evaluate frontier attack agents across attack depth, network scale, and task information. Among runs that compromise the entry vulnerability, 24.5–47.0% still fail to complete the remaining attack path, revealing a substantial sustained-compromise gap between establishing an initial foothold and completing a multi-hop attack. RangeFactory further produces a corpus of 5,541 outcome-annotated multi-hop attack trajectories, providing execution data for attack-process analysis and future agent training.

Introduction

Large language model agents are evolving from executing isolated instructions to autonomously completing long-horizon tasks in complex environments. This trend is extending agent autonomy to cybersecurity, where real-world intrusions often require sustained progress across multiple network positions. A cyber range is an interactive network environment for executing and validating cyberattacks; a multi-hop cyber range further requires an attacker to use footholds established by earlier compromises to reach targets in distinct network segments. Such environments therefore provide the infrastructure for systematically studying whether attack agents can sustain multi-hop compromise.

Prior work has developed two classes of resources for evaluating attack agents. One line scales the conversion of real vulnerabilities into executable single-vulnerability tasks, but each task ends at an isolated exploit and cannot evaluate sustained compromise across network positions. Another line uses multi-host cyber ranges to evaluate end-to-end attacks, but existing benchmarks depend on a small collection of expert-designed, fixed scenarios. Automated scenario-generation systems can expand environment deployment, yet still require experts to specify cross-vulnerability dependencies in advance. As a result, existing works cannot automatically set up the environments that support complete attack chains. Therefore, this paper addresses how to automatically transform the growing supply of single-vulnerability environments into multi-hop cyber ranges with executable end-to-end attack paths.

The central challenge in this transformation is automatically making independently exploitable vulnerabilities execute consecutively within one attack. This requires resolving both capability and runtime dependencies. A capability dependency determines whether adjacent attacks can connect; for example, file-read access cannot support a subsequent exploit that requires command execution. A runtime dependency determines whether the concrete attack procedure can operate from its new foothold; for example, a network policy may block an exploit’s callback. Directly composing vulnerability environments and executing every combination creates a rapidly growing candidate space. Dependency-guided orchestration can eliminate known dependency conflicts before deployment, while conditions introduced by joint deployment still require complete attack execution. Scalable construction therefore first composes candidates whose dependencies can connect and then executes each end to end to confirm that the path remains feasible.

Based on this observation, we present RangeFactory, a multi-agent system that automatically transforms isolated vulnerability environments into validated multi-hop cyber ranges. RangeFactory views range construction as a dependency-resolution process: it characterizes dependencies through actual attacks, resolves them through scenario orchestration, and validates the resulting runtime conditions through end-to-end execution. Atomization agents attack each CVE environment and probe its post-exploitation capabilities, producing a CVE Capability Atom with dependency information and a reusable attack procedure. Orchestration agents generate attack-path templates and bind compatible Atoms, after which Validation agents execute the complete attack against hidden objectives. Diagnostic feedback supports attack retries and subsequent path construction. Every retained range thereby contains a path successfully exercised during construction.

Using 239 CVE Capability Atoms and 20 enterprise-style network configurations, RangeFactory produces 1,840 candidate range instances. End-to-end validation retains 1,148 instances spanning 287 distinct ordered attack chains, for a validation rate of 62.4%. We organize them into RangeBench and evaluate frontier attack agents across attack depth, network scale, and task information. The results reveal a substantial sustained-compromise gap: success on an entry vulnerability does not reliably translate into completing the attack when the same path is extended across additional network layers. Beyond evaluation, RangeFactory constructs a corpus of 5,541 outcome-annotated multi-hop interaction trajectories from the same ranges. Validated demonstrations and autonomous outcomes share verifier-derived milestone annotations that may support future attack-agent training.

Contributions

• RangeFactory: An automated multi-agent framework that derives vulnerability dependencies through actual attacks and combines orchestration with end-to-end validation to construct multi-hop cyber ranges at scale.

• RangeBench and Empirical Findings: A benchmark with 1,148 validated range instances spanning 287 distinct attack chains, systematically studying how attack depth, network scale, and task information affect frontier attack agents, revealing a substantial gap between early compromise and sustained multi-hop compromise.

• Outcome-Annotated Attack Trajectories: A corpus of 5,541 multi-hop trajectories pairing validated demonstrations with autonomous outcomes on the same ranges, with verifier-derived milestone annotations that may support future attack-agent training.

Related Work

Recent work has transformed real vulnerabilities into executable tasks, grounding cyber-agent evaluation in actual interaction. Automated vulnerability reproduction further converts sparse CVE metadata into complete single-vulnerability task packages. Complementary benchmark efforts package professional CTF and penetration-testing challenges as reproducible interactive environments. Beyond benchmark construction, cybersecurity-agent data have been scaled from CTF artifacts: runtime-free methods synthesize trajectories from writeups, while execution-grounded platforms collect verified rollouts from containerized challenges. These resources remain centered on individual vulnerabilities or challenges. Multi-host cyber-range benchmarks evaluate how agents expand an initial foothold across a network, but rely on a small, fixed collection of ranges. RangeFactory addresses this environmental bottleneck and collects outcome-annotated multi-hop interactions as a downstream artifact of range construction and evaluation.

A separate line of work automates cyber-range construction. Attack-graph methods derive multi-host attack chains from formal system models. Cyber-range generators instantiate expert-authored scenario models, while model-driven approaches support automated deployment validation. LLM-based systems further translate natural-language range requirements into platform-specific configurations and deployment artifacts, while constraint-based synthesis uses model finding and capability semantics to generate enterprise scenarios at scale. These approaches automate cyber-range construction once authored scenario descriptions or predefined composition semantics are available, but adding a new vulnerability still requires its attack dependencies to be specified in advance. RangeFactory obtains these dependencies from successful attacks against existing vulnerability environments, uses them to orchestrate candidate chains, and then executes each deployed chain end to end to detect unresolved runtime incompatibilities introduced by composition.

System Design

Insight and Overview

Deploying independently exploitable CVE environments together does not yield a valid multi-hop attack chain unless both capability and runtime dependencies hold. A capability dependency concerns what an attack requires and produces: a preceding compromise must provide the capability needed by the next exploit. File-read access, for example, cannot support an exploit that requires command execution. A runtime dependency concerns whether the concrete attack procedure can operate from its new execution position. A blocked reverse connection or a missing tool on the compromised host can prevent exploitation even when the capability interface matches. Either violation breaks the consecutive execution of otherwise exploitable CVEs.

RangeFactory views multi-hop range construction as dependency resolution: actual attacks characterize dependencies, orchestration resolves them, and end-to-end execution confirms candidate-chain executability. Single-vulnerability attacks reveal the capabilities required and produced and record the runtime requirements observed during exploitation. Orchestration connects consecutive capabilities and uses the network template to constrain known runtime dependencies. Because the new footholds and joint deployment can introduce conditions that were absent from the single-vulnerability environment, RangeFactory then executes the complete attack to expose remaining conflicts. This division prunes clearly infeasible compositions before deployment while retaining only chains successfully exercised after composition.

RangeFactory’s multi-agent workflow consists of three stages: Atomization produces CVE Capability Atoms, Orchestration binds them into candidate ranges, and Validation exercises the complete attack before acceptance. Diagnostic feedback is routed to attack execution for bounded retry or to chain construction as persistent incompatibility evidence.

CVE Capability Atom

RangeFactory represents each successfully attacked vulnerability environment as a CVE Capability Atom, which binds the deployable environment to dependency information and execution artifacts. It has four fields:

• exploit access: Structured preconditions including attack vector, privilege, and service protocol/port.

• capability grants: Verified post capability from a fixed ontology, with principal and evidence.

• exploit guide: Successful procedure with tool, material, authentication, and callback requirements.

• poc materials: Exploit artifacts referenced by exploit guide.

The capability ontology represents command execution (execute command), file access (read file and write file), network position (network vantage), credential discovery (read credential), and authentication (authenticate). For example, when exploit access requires an internal service, the preceding compromise must provide network vantage. A TCP callback requirement is instead recorded in exploit guide for runtime compatibility checking. Capability matching uses only grants confirmed by probes, avoiding chains supported by an Agent’s unverified inference. Runtime dependencies vary with the composed environment and cannot be completely exposed by a single-vulnerability attack, so the Atom records observed requirements and leaves the remainder to end-to-end validation.

Atomization

The Exploiter deploys a reproducible vulnerability environment, configures a private objective aligned with the vulnerability impact, and provides the Exploiter with its reproduction context and available exploit materials. The Exploiter adapts the attack according to environment feedback, while an independent verifier confirms success against the private objective. After a successful attack, it distills the procedure, exploit conditions, and observed runtime dependencies into exploit guide. This establishes for every Atom an execution-confirmed attack for subsequent range construction.

The Explorer reuses the Exploiter’s environment and established foothold, selecting capability probes according to the available access mechanism and probe feedback. For example, it directs the compromised host to a designated endpoint to confirm network vantage. Only capabilities confirmed by probes and their corresponding principals enter capability grants. This process converts heterogeneous vulnerability impacts into a uniform interface for subsequent orchestration.

Orchestrator

The Generator transforms public architecture references into parameterized enterprise-style templates. Each template defines the network structure and communication policies and marks an attack-chain skeleton from an external entry point to the final objective. It reserves one CVE slot in every traversed layer and independently parameterizes background business assets to control the search space. For example, a three-tier template can traverse a DMZ, an internal application network, and a data network. The template fixes chain structure and network-dependent constraints while keeping Atom selection open.

The Composer takes a scenario template and a library of verified Atoms as input and constructs candidate bindings in attack-chain order. For each CVE slot, it retrieves Atoms whose service requirements are compatible with the template position and checks whether the capabilities accumulated at preceding positions satisfy the next Atom’s exploit access. After each binding, the Composer associates the Atom’s capability grants with the current network position and updates the capability set through fixed closure rules. For example, verified command execution can support file access and network vantage under the same principal. A partial chain is pruned as soon as a dependency is violated, after which the Composer backtracks to another Atom.

Beyond capability dependencies, the Composer combines the network template with exploit guide to check runtime requirements that can be determined before deployment, such as the attack’s execution position and material delivery. The concrete exploit procedure and runtime dependencies that emerge only in the composed environment are left to end-to-end execution. Once all slots are bound, the Composer forms an attack graph whose nodes are Atom-bound template positions and whose edges are dependency-satisfying attack transitions. When the candidate set is large, it prioritizes chains that expand coverage of Atom and asset configurations. The output records Atom bindings, capability transitions, and deployment parameters for range instantiation and validation.

Validation

The Executor checks that all nodes and services operate under the network configuration defined by the template. It accesses each Atom’s execution artifacts, organizes the per-hop exploits into an end-to-end attack, and adapts them as the foothold and runtime environment change. A verifier independently checks the ordered private objectives hidden from the Executor. Only a candidate that completes the end-to-end attack is accepted; the complete trajectory and verification result are retained, while failed executions are passed to the Diagnoser.

The Diagnoser locates the failed step from the trajectory and env…

Improvements to AI systems based on this paper:

1. Sustained-compromise training objective: Train agents with a multi-hop success metric that explicitly penalizes stopping after initial foothold. The paper shows 24.5–47.0% of runs fail after entry compromise, so add a loss term or reward shaping that requires completing the full chain, not just the first objective.

2. Dependency-aware planning module: Add a planning layer that models capability dependencies (e.g., file-read cannot support command-execution exploits) and runtime constraints (e.g., callback ports, tool availability) before acting. This mirrors RangeFactory’s orchestration and would reduce infeasible action sequences in long-horizon tasks.

3. Hierarchical task decomposition with verifier feedback: Implement a two-level controller: a high-level planner that selects sub-goals (like the Atom chain) and a low-level executor that adapts per-hop actions. Use verifier-derived milestone annotations to provide intermediate rewards, improving credit assignment across hops.

4. Diagnostic-guided retry mechanism: Add a failure-analysis module that distinguishes execution errors from compositional incompatibilities. On failure, it either retries with context-preserving adjustments (recovering 31 vs. 14 attacks without diagnosis) or updates a persistent incompatibility memory to avoid repeating known dead-ends.

5. Scale-aware cost modeling: Train agents to predict interaction cost (tool calls, time) as network scale grows (51–74% more calls, 71–84% more time). Use this to allocate search budget dynamically, prioritizing deeper exploration when early hops succeed quickly.

6. Information-level adaptive behavior: Develop agents that actively request or infer missing topology and service details when task information is low (L0/L1), since the paper shows a 3–4x performance gap between L1 and L2. This could involve a meta-learning module that maps partial observability to exploration strategies.

7. Trajectory-based contrastive learning: Use the 5,541 outcome-annotated trajectories to train agents via contrastive methods—pairs of successful and failed rollouts on identical ranges (same chain, same scale) provide natural positive/negative examples for learning robust attack policies.

8. Validation-aware action selection: Incorporate a lightweight internal verifier that checks whether proposed actions satisfy known capability and runtime dependencies before execution, reducing wasted turns on infeasible exploits (similar to pruning 92.3% of candidates pre-deployment).

What the improved AI system can do:

• Complete multi-hop attack chains with significantly higher end-to-end success (targeting >80% conditioned on entry, vs. current 53–75.5%)

• Operate effectively under sparse task information by actively discovering network topology and service dependencies

• Adapt to larger network scales without proportional cost increases, using predictive budgeting

• Recover from failures via diagnostic-guided retries rather than restarting or stopping

• Learn from both successful demonstrations and failed attempts to avoid repeating compositional errors

• Provide reliable, verifiable progress milestones at each hop, enabling better human oversight and trust in autonomous operation