Research

Attackers Put Malware on Quantum Systems' Drone Update Server, and Germany Grounded Its Drones. Stage Every Vendor Update to Your Mission Computers.

Patrick Duggan · · 5 min read

Attackers Put Malware on Quantum Systems' Drone Update Server, and Germany Grounded Its Drones. Stage Every Vendor Update to Your Mission Computers.

If you fly drones, or run any equipment whose vendor pushes software to you, stop treating the vendor's update server as trusted. Quantum Systems, one of Europe's largest military drone makers, says attackers got inside its network. Two newspapers report that a malicious file sat on its update server disguised as a normal update to QBase, the software that plans the drones' missions. The file reached servers at the German military and other customers, and the Bundeswehr grounded the drones as a precaution. The fix is the same for every vendor update channel: install updates on a test machine first, check the hash or signature against a value the vendor gives you through a separate channel, and keep mission-planning computers off networks that can reach the internet on their own.

What the company says

Quantum Systems published a statement on its website on November 12. We could not read it: the page returned HTTP 403 to us. These are its words as quoted by the outlets that did read it:

  • It "detected a cybersecurity incident in late October," and its investigation found an "active cyberattack by hostile actors" (Militarnyi).
  • "The European defence industry has been facing persistent cyberattacks for years. Companies at the forefront of supporting Ukraine are being targeted precisely because our work is critically relevant to customers' security" (Militarnyi, DroneXL).
  • "Through the quick measures taken and the characteristics of the incident, there is no risk in operating Quantum Systems' unmanned systems for the end users and the operators" (UNITED24, quoting the Financial Times).
  • "The fleet is operating normally around the globe – including Germany and the Bundeswehr," and "The Bundeswehr was the only customer to ground their systems as a precaution" (shattered.io, citing The Register, November 13).

The company names no attacker. It says it reported the incident to the authorities and the investigation continues.

What the newspapers report

Everything technical below comes from two reports, Der Spiegel and the Financial Times. Both are paywalled and we did not read them. Every other outlet we read repeats one or both. So this is two sources, not seven.

  • The path. Unknown attackers got into the company network and left malware on an internal update server, disguised as a regular QBase update (Der Spiegel, via DroneXL and Militarnyi). The FT says the company told customers a malicious update file had gone out through the QBase update server (via UNITED24 and Dronewatch).
  • How far it got. The file reached servers at the Bundeswehr and "other customers." It "did not reach the drones," and a check caught it (Der Spiegel, via DroneXL).
  • The grounding. The Bundeswehr grounded the drones for a time, which kept Quantum Systems out of a recent exercise (FT). Reports disagree on how many: "entire fleet" (Der Spiegel, Militarnyi), "a substantial number" (Dronewatch), a flight ban in Germany only (Handelsblatt, citing the company).
  • The drone. QBase plans missions for the Vector reconnaissance drone, which the Bundeswehr flies as the Falke and which Quantum Systems also supplies to Ukraine.
  • Who is investigating. Germany's military counterintelligence service (MAD), the domestic intelligence service (BfV) and the federal cyber agency (BSI), according to Der Spiegel. One outlet attributes the same list to the company's own statement.

What is not known

  • Whether the update was signed, and whether Quantum Systems signs QBase updates at all. No report says.
  • When the file went out, and how long it sat on the server.
  • What the malware was built to do. No report says, and none says it was installed and ran on a mission-planning computer.
  • Ukraine. The FT says it is not clear whether Ukrainian operations were affected. One headline implied they were. Its own article does not say so.
  • Return to service. The company says the drones flew again from November 13. The German defence ministry declined to discuss it.
  • Indicators. No hashes, file names, version numbers, domains or IP addresses have been published. We have added nothing to our feed.

Why the update server is the target

Attackers who want into a well-defended customer go through the vendor that customer already trusts. The update server is the best seat in that house: one file placed there gets carried inside by the customer's own staff, through every firewall, onto the machines that matter. On November 4 we wrote about the same move against cPGuard, a server security tool whose own update channel shipped a root backdoor to about 2,950 servers in 70 minutes. The equipment changes. The path does not.

QBase is a good target for the same reason any ground-control or engineering workstation is. It sits next to the thing you actually care about, and it is updated by people who expect the update to be safe.

What to do

  1. Stage vendor updates. Install every update for mission planning, ground control, PLC programming or other operational software on a test machine first. Nothing reaches the operational machine until it has run there.
  2. Verify out of band. Get the expected hash or signing certificate from the vendor through a different channel than the download: a support portal behind your own login, a signed advisory, or a phone call. A hash served by the same compromised server proves nothing.
  3. Ask your vendor three questions: do you sign your updates, where is the signing key kept, and how would you tell us if your update server were compromised. A vendor that cannot answer the third is telling you that you would find out from the newspapers.
  4. Turn off automatic updates on operational machines. The machine should not be able to fetch its own updates. Your staff should bring them in after step 2.
  5. Segment the planning computers. Mission-planning and ground-control machines should not have general internet access. Log what they do connect to, and alert on anything new.
  6. If you run QBase, contact Quantum Systems for the hash of every update you installed since October 1 and the hash of the malicious file, and compare them against what you have. Until the company publishes indicators, that comparison is the only check you can make.

How we know

We read DroneXL (November 12), Dronewatch Europe (November 12), Militarnyi (November 13), UNITED24 Media (November 13), shattered.io (updated November 14) and BleepingComputer (November 13), all returning HTTP 200. Quantum Systems' own statement returned HTTP 403, so every company quote above is as another outlet reported it. The technical claims trace to Der Spiegel and the Financial Times, which we did not read. Where outlets disagree, we have said so above instead of picking one.

Sources

  • BleepingComputer, "German military drone operations disrupted by cyberattack," November 13, 2026: https://www.bleepingcomputer.com/news/security/german-military-drone-operations-disrupted-by-cyberattack/
  • DroneXL, November 12, 2026: https://dronexl.co/2026/11/12/quantum-systems-qbase-malware-bundeswehr-grounds-drones/
  • Dronewatch Europe: https://www.dronewatch.eu/cyberattack-forces-german-military-to-ground-quantum-systems-drones/
  • Militarnyi: https://militarnyi.com/en/news/cyberattack-on-quantum-systems-hackers-attempted-to-infect-updates-for-drones-used-by-ukraine-in-particular/
  • UNITED24 Media: https://united24media.com/world/one-of-europes-top-drone-startups-hit-by-cyberattack-grounding-german-military-fleet-24360
  • shattered.io (German): https://shattered.io/de/quantum-systems-cyberangriff-qbase-update-server-bundeswehr-drohnen
  • Quantum Systems statement (HTTP 403 to us): https://quantum-systems.com/news/cyberattack-defeated/
  • Der Spiegel (paywalled, not read): https://www.spiegel.de/politik/massiver-cyberangriff-auf-drohnenhersteller-quantum-systems-a-354b0289-2281-4af6-a532-ee03b45d8b30
  • Financial Times (paywalled, not read): https://www.ft.com/content/783504cd-aa28-453a-a223-7a34eee86ce8

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register