Google Threat Intelligence Group reports that attackers are using multi-agent pentesting tools in live intrusions, increasing the speed and scale of reconnaissance, privilege escalation and data-theft preparation.