Search papers, labs, and topics across Lattice.
This paper introduces RangeFactory, an automated framework designed to construct scalable multi-hop cyber ranges from isolated vulnerability environments, addressing the limitations of previous methods that relied on manual orchestration. By formulating range construction as a dependency resolution problem, RangeFactory successfully validates 1,148 range instances across 287 distinct attack chains, revealing a significant gap in sustained compromise during multi-hop attacks. The findings highlight that 24.5-47.0% of attempts to complete attack paths fail even after compromising the initial vulnerability, underscoring the challenges in orchestrating effective multi-hop cyberattack simulations.
Despite breaching initial vulnerabilities, 24.5-47.0% of multi-hop attacks fail to complete, exposing critical gaps in cyber range effectiveness.
Real-world cyberattacks often require sustained progress across multiple hosts and network segments, making multi-hop cyber ranges essential infrastructure for studying and improving LLM agents'ability to sustain complete attack chains. Prior work has scaled isolated vulnerability tasks and constructed multi-host scenarios from manually specified vulnerability semantics. However, they are still unable to automatically orchestrate the growing supply of vulnerability environments into end-to-end validated multi-hop ranges. To this end, we present RangeFactory, an automated cyber-range orchestration framework that constructs multi-hop cyber ranges at scale from isolated vulnerability environments. RangeFactory formulates range construction as dependency resolution: it extracts dependency information from agents'actual attacks against real vulnerabilities, resolves known dependencies through template-guided orchestration, and uses end-to-end attack execution to validate runtime dependencies that emerge after composition. Using RangeFactory, we construct RangeBench with 1,148 validated range instances spanning 287 distinct attack chains and evaluate frontier attack agents across attack depth, network scale, and task information. Among runs that compromise the entry vulnerability, 24.5-47.0% still fail to complete the remaining attack path, revealing a substantial sustained-compromise gap between establishing an initial foothold and completing a multi-hop attack. RangeFactory further produces a corpus of 5,541 outcome-annotated multi-hop attack trajectories, providing execution data for attack-process analysis and future agent training.
