Threat watch / Attack
Quantum Systems: malware disguised as a drone software update, Bundeswehr grounds its drones
German drone maker Quantum Systems says it detected "an active cyberattack by hostile actors" in October and contained it with the authorities. According to the Financial Times, reported by Dronewatch and DroneXL, the attackers placed a malicious file on the server Quantum uses to distribute updates of QBase, its ground control and mission planning software. The Bundeswehr grounded its Quantum drones as a precaution. Quantum told Reuters on November 13 that the fleet is flying again and that the Bundeswehr was the only customer to ground its systems. Who is behind it and how they got in are not public.
- Sector
- Tech & SaaS
- Way in
- Not public yet
- Product or vendor
- Quantum Systems, QBase, Vector
- How it happened
- According to the Financial Times, reported by Dronewatch, hackers distributed a malicious update file through a server used for QBase updates. Der Spiegel, reported by DroneXL, says unknown attackers got into the Quantum Systems network and left the malware on an internal update server, disguised as a regular QBase update. How they first got into the network is not public.[2][3] Checked 13 Nov 2026
- What was stolen
- Not public yet Checked 13 Nov 2026
- Who was impacted
- The Bundeswehr, which flies Quantum's Vector reconnaissance drone (called Falke), grounded its Quantum drones as a precaution; the FT reports it suspended "a substantial number" of them and that Quantum missed a recent military exercise. According to Der Spiegel, reported by DroneXL, the file reached servers at the Bundeswehr and other customers but was caught by a check before it reached the drones. Quantum says the Bundeswehr was the only customer to ground its systems, and that the fleet now operates normally, including in Germany.[1][2][3] Checked 13 Nov 2026
- Threat actor
- Not attributed. Not named. Quantum Systems speaks only of "hostile actors" and has not said who it believes is responsible.
Timeline
- The Financial Times reports that the Bundeswehr grounded Quantum drones after a malicious file was distributed through the QBase update server. Quantum confirms the same day that it detected "an active cyberattack by hostile actors" at the end of October and contained it "in close and transparent collaboration with the authorities". Der Spiegel reports that military counterintelligence (MAD), domestic intelligence (BfV) and the federal IT security office (BSI) are investigating. [1][2][3][4]
- Quantum tells Reuters that "the fleet is operating normally around the globe — including Germany and the Bundeswehr" and that "the Bundeswehr was the only customer to ground their systems as a precaution." The German military had no immediate comment. [1]