Quantum Systems Hack: How a Fake Update Grounded Germany’s Drones

WarBrief Live | November 13, 2026 | Cybersecurity

Attackers hid malware in a fake QBase software update for Quantum Systems drones. The file reached German military servers before a check caught it, the Bundeswehr grounded its Vector fleet, and the company says the drones are flying again.

The incident, confirmed by Quantum Systems on November 12, is a textbook supply-chain attack: the target was not the aircraft, but the trusted channel that delivers software to them. The Register reported that the German military has now lifted its precautionary grounding, but the questions the attack raises — who did it, what the malware was built to do, and which customers received it — remain open.

What happened in the Quantum Systems hack?

Quantum Systems, the Bavarian drone maker founded in 2015, detected a cybersecurity incident at the end of October. Its internal investigation identified what the company called an “active cyberattack by hostile actors”. The company confirmed the attack publicly on the evening of November 12, the same day the Financial Times and Der Spiegel first reported the grounding of the Bundeswehr fleet.

According to Der Spiegel, unknown attackers got into the company’s corporate network and left malware on an internal update server, dressed up as a regular update for QBase, the ground control and mission planning software used with the Vector reconnaissance drone. The Financial Times account matches: a person familiar with the matter told the paper that Quantum Systems informed customers a malicious update file had gone out through the server that distributes QBase updates.

The file reached servers at the Bundeswehr and at other customers. It did not reach the drones, and a check caught it before it got near any aircraft. No report published so far says the file was installed on a mission-planning computer, and none says what the malware was built to do.

The Bundeswehr grounded its Quantum Systems drones as a precaution. Accounts of the grounding differ on scope and timing: Der Spiegel says the military grounded the entire fleet last month, for a time, while the Financial Times reported that the decision kept Quantum Systems out of a recent exercise with the military. Handelsblatt, citing the company, reported a Bundeswehr flight ban for the drones in Germany and said the fleet outside Germany remained in regular use. Germany’s defence ministry told the Financial Times it does not discuss the readiness of military equipment, and declined to comment to dpa-AFX.

“The threat was contained thanks to the swift response of our IT and security teams in close and transparent collaboration with the authorities. Through the quick measures taken and the characteristics of the incident, there is no risk in operating Quantum Systems’ unmanned systems for the end users and the operators.”

— Quantum Systems statement, November 12, 2026

By November 13, the company was telling Reuters that the fleet was flying again. “The fleet is operating normally around the globe – including Germany and the Bundeswehr,” Quantum Systems said. “The Bundeswehr was the only customer to ground their systems as a precaution.”

What is QBase — and why was it the target?

QBase is ground software. The Financial Times calls it a ground control and mission planning system, and Quantum Systems’ own page for QBase 3D describes a Windows program for mission planning, flight monitoring and data post-processing. It is the software operators use to plan flights for the Vector, the company’s tactical reconnaissance drone — flown by the Bundeswehr under the name Falke, and supplied in large numbers to Ukraine’s Defence Forces.

That is what made it a valuable target. A customer installs what its supplier sends, and a military customer does that inside a military network. Compromise the update server once, and the malicious file is delivered to every customer that trusts it — including, in this case, the armed forces of a NATO state. The drones themselves, which fly with their own onboard systems, were never the way in.

The choice of target also fits a wider pattern. Quantum Systems is not a marginal supplier: the Financial Times lists Germany, Spain and the Netherlands as military customers, and the company was valued at around $8 billion after a $1.2 billion Series D funding round in July, according to The Register. Germany had planned to order 520 Falke systems for delivery in 2026, DroneXL reported in December 2025 — a figure that has not been independently confirmed since the attack. For defenders, the lesson is the same one that followed the November 2 fridge attacks across 11 European countries: the softest point in a defence network is often a supplier’s IT system, not a weapon.

How does a fake software update attack work?

A fake software update attack is a form of supply-chain attack. Instead of breaking into the victim’s systems directly, the attacker breaks into a trusted supplier and tampers with something the victim already expects to receive — in this case, a software update. Because the file arrives through a legitimate channel, from a legitimate vendor, it can pass the checks that would stop an ordinary intrusion. It is caught only when something about the file itself — its signature, its contents, its behaviour — fails a verification step further down the chain.

That is what appears to have happened here: the malicious QBase file was distributed through the company’s own update server, reached customer servers, and was picked up in a check before it reached the aircraft. The mechanism is the same one security teams have warned about for years, and it is why vulnerability assessment for defence contractors now covers supplier networks as well as the systems a contractor builds. A single compromised update server can reach every customer at once, which is precisely what makes it worth attacking.

Three German agencies are now working the case: the Bundeswehr’s military counterintelligence service (MAD), the Federal Office for the Protection of the Constitution (BfV) and the Federal Office for Information Security (BSI). The BfV warned in July that Germany’s defence sector — and companies supporting Ukraine in particular — faced a higher risk of Russian cyber attacks, espionage and sabotage. That warning is reported, not a finding about this attack: no attacker has been named, Quantum Systems refers only to “hostile actors”, and no published report connects this incident to any state.

European drone makers have been targets before. In October 2025, ESET reported that North Korea’s Lazarus group was going after European drone makers, and in August Poland’s ABW began investigating whether a fire at a WB Electronics plant that makes drone parts was sabotage. None of the reports on the Quantum Systems incident connects either case to this attack, and treating them as connected would be speculation.

Quantum Systems hack: the numbers

Figures marked REPORTED rest on a single source and have not been independently confirmed. CONFIRMED figures are backed by two or more sources.

Why the Quantum Systems hack matters for Ukraine

The Vector is one of the reconnaissance drones Ukraine’s Defence Forces fly, and Quantum Systems’ Ukrainian footprint is large: more than 200 staff in Ukraine and three joint ventures with Ukrainian companies that build small attack drones, interceptors and ground vehicles, according to the Financial Times. The paper says it is not clear whether those Ukrainian operations were affected by the attack.

The stakes go beyond reconnaissance. Last month, Chancellor Friedrich Merz announced funding for “several tens of thousands” of Quantum Systems interceptor drones as part of Germany’s winter aid package, with the new drones to be built in Ukraine in support of interceptor systems already in use on the front lines. A compromised update channel for the company that builds those systems is therefore not only a German problem — it is a question for every military that flies its aircraft, and for the Ukrainian units that depend on them.

That is also why attribution matters, and why it is worth waiting for. State-linked cyber operations against Ukraine’s supporters are a documented pattern — our reporting on the APT29 “Poisoned Source” campaign shows how ordinary websites have been turned into traps for phones — but an unproven attribution in this case would mislead more than it informs. The investigating agencies have not named anyone, and the company has not said who it suspects.

What the Quantum Systems hack means for US/UK/EU readers

For readers in the United States, the direct exposure is limited but the lesson is not. Quantum Systems also sells in the US, and the same update-server logic applies to every defence supplier in the American procurement chain: a vendor’s IT network is part of the weapon system’s attack surface. The incident is a reminder that software assurance — signed updates, verified distribution, checks before installation — is now a procurement question, not only an IT one.

For the UK and the EU, the implications are closer to home. The Financial Times lists Germany, Spain and the Netherlands as military customers for Quantum Systems, and the company’s drones fly with NATO allies. The BfV’s July warning about the German defence sector applies by extension to the European defence industrial base, which is scaling up production for Ukraine at the same time as it is being targeted. European readers should expect more disclosure requirements and more scrutiny of supplier cyber hygiene in defence contracts — and more stories like this one, as attackers follow the same logic to other suppliers.

There is no travel or consumer impact from this incident, and no market shock: the company’s valuation and its order book were reported as intact. The cost so far is measured in grounded aircraft, a missed exercise, and trust — the last of which is the hardest to restore, because a supplier whose update channel was compromised must now prove, customer by customer, that the channel is clean.

What to watch next for Quantum Systems and the Bundeswehr

Five things will decide how this story develops. First, attribution: whether MAD, the BfV and the BSI name an actor, and on what evidence. Second, disclosure: whether Quantum Systems publishes a plain account of which servers received the malicious file and what it was built to do — the detail customers and the public still lack. Third, whether other customers beyond the Bundeswehr disclose that they received the file, and what they found. Fourth, whether Germany’s planned 520-system Falke order proceeds on schedule, and whether the grounding affects delivery timelines. And fifth, whether the incident changes how defence ministries verify supplier software updates — the policy question that outlasts any single attack.

We will update this story as the investigation develops. For the wider picture, see our intelligence hub and our conflict zones hub.

Frequently asked questions

What is QBase?
QBase is Quantum Systems’ ground control and mission planning software, used to plan flights for the Vector reconnaissance drone, monitor flights and process data from the ground. The Bundeswehr flies the Vector under the name Falke.

Were the drones themselves hacked?
No. The malicious file was planted on Quantum Systems’ internal update server and reached Bundeswehr and other customers’ servers, but it was caught in a check before it reached any aircraft. The company says there is no risk in operating its drones.

Who hacked Quantum Systems?
No attacker has been named. Quantum Systems calls the intruders “hostile actors” and has not said who it suspects. Three German agencies — MAD, the BfV and the BSI — are investigating.

Are Quantum Systems drones still flying?
Yes, according to the company. Quantum Systems told Reuters on November 13 that the fleet is operating normally around the globe, including in Germany with the Bundeswehr, and that the Bundeswehr was the only customer to ground its systems as a precaution.

What is a supply-chain attack?
A supply-chain attack targets a trusted supplier rather than the victim directly — for example, by tampering with a software update the victim already expects to receive. Because the file arrives through a legitimate channel, it can reach many customers at once before it is detected.

Sources

• The Register: Quantum Systems drones back in the air after malware scare
• DroneXL: Quantum Systems Hack: Fake Update Got German Military Drones Grounded
• Militarnyi: Cyberattack on Quantum Systems: Hackers Attempted to Infect Updates for Drones Used by Ukraine in Particular
• Dealroom: A hacked software update grounded Quantum Systems’ drones in the German military
• Insurance Business: Hacked software update grounds German army drones and tests cyber exclusions