Breaches

Drone maker Quantum Systems hit by poisoned QBase software update

Quantum Systems confirms an October breach after a fake QBase update reached military servers and the Bundeswehr grounded its drones. UK lessons.

Warning graphic with the headline 'Poisoned update grounds military drone fleet' for a supply chain attack story

German drone manufacturer Quantum Systems has confirmed a cyberattack by hostile actors that it detected in October, and reports say a malicious update for its QBase mission-planning software reached military servers. The Bundeswehr grounded its fleet as a precaution, which is a reminder to UK defence suppliers, and anyone who ships software updates to customers, that the update channel is a prime target.

What happened

Quantum Systems, the German firm whose Vector reconnaissance drones serve with the German armed forces as Falke, published a statement on Thursday 12 November confirming it had detected “an active cyberattack by hostile actors” at the end of October. The company says its IT and security teams contained the incident and worked with the relevant authorities. It also says there is no risk to anyone operating its unmanned systems.

The detail came from elsewhere. Der Spiegel, citing unnamed sources, reported that malware was found in an update for QBase, the ground-control and mission-planning software that operators use to plan flights, monitor missions and process collected data. According to that reporting, the tampered update reached servers belonging to the Bundeswehr and to other customers. It did not reach the aircraft themselves.

According to the Financial Times, the Bundeswehr took the aircraft out of service, which kept them out of a recent exercise. A company spokesperson told Reuters that no other customer grounded its systems and that the fleet is now operating normally, including in German service. The German defence ministry has declined to comment. Military counterintelligence (MAD), the domestic intelligence service (BfV) and the federal cyber security office (BSI) are reported to be involved.

No group has been named. Quantum Systems says it was targeted “precisely because our work is critically relevant to customers’ security”, and BleepingComputer reports it believes its support for Ukraine was a factor. In October, Chancellor Friedrich Merz announced German funding for a large batch of its interceptor drones, to be built in Ukraine.

The technical picture

Public detail is thin. The reported attack path is a compromise of the vendor’s update distribution server, used to plant a file posing as a routine QBase update. That puts the incident in the same family as other software supply chain attacks. The attacker does not need to break into each customer. They abuse the trust customers already place in a supplier’s update mechanism.

Several things remain unclear. Nobody has said publicly what the malware was designed to do, how long the update server was compromised, or how many customers downloaded or installed the file. DroneXL’s summary of the reporting says a check caught the file, but how and when it was detected have not been published. We also do not know whether the update was correctly signed, which would mean signing keys or the build pipeline were also at risk, or whether the server simply delivered an unsigned package that customer systems accepted.

The distinction matters a great deal. If the package was signed, the attacker had reach into the build or signing process and defenders cannot rely on signature checks. If it was not signed, the lesson is about how customers validate what they install. Until Quantum Systems or the German authorities say more, organisations should plan for both possibilities.

Ground-control software is a particularly sensitive place to land. It sits between operators and aircraft, handles mission plans and imagery, and often runs on networks with access to classified or operationally sensitive data. Malware there could, in principle, support espionage or disruption, which explains why the Bundeswehr grounded first and asked questions later.

Timeline of the Quantum Systems QBase incident, from detection in late October to the company's confirmation on 12 November 2026

Why it matters for UK organisations

This is not a purely German story. Quantum Systems set up a UK subsidiary, Quantum-Systems Ltd UK, after buying Nordic Unmanned UK, and announced plans in September 2025 to invest up to €50 million in Britain over five years. That plan covers engineering, maintenance, training and partnerships with UK providers, including a planned memorandum of understanding with Skyports. UK partners and any British users of its software should be asking direct questions now rather than waiting for a public post-mortem.

The wider point is about the UK defence supply chain. British companies supplying Ukraine, or supplying the Ministry of Defence, are exposed to the same motive the company describes. Their software is just as attractive a route in as their hardware.

There is also a regulatory angle. The Cyber Security and Resilience (Network and Information Systems) Bill, which is still before Parliament, would bring medium and large managed service providers into the UK’s NIS regime and let regulators designate critical suppliers to essential and digital services, according to the government’s summary of the Bill. This incident is exactly the kind of supplier risk those powers target.

Expert view

In my experience, update infrastructure is one of the least tested parts of a software vendor’s estate. Penetration tests tend to focus on the product and the corporate network. The server that hands out installers sits in between, often on a web host or content delivery service, sometimes administered by a small team with shared credentials. When we test it, we often find weak administrative access, missing logs and no independent check that what is published matches what the build system produced.

I would credit the Bundeswehr with the right instinct. Grounding a fleet is expensive and embarrassing, but if you cannot rule out that your mission-planning layer has been tampered with, flying on regardless is the bigger risk.

Equally, the vendor’s statement that the threat was contained is welcome but not yet evidenced in public. Customers deserve indicators of compromise, the affected version numbers and a clear timeline. Until those appear, I would treat “no risk” as the vendor’s assessment, not an independent finding.

What to do now

  1. If you use Quantum Systems software: contact the vendor for the affected QBase versions, dates and indicators of compromise, and check which updates your servers pulled in October and November.
  2. Stage vendor updates: do not let critical operational software update itself straight from the internet. Pull updates into a controlled repository, verify them and deploy in waves (Cyber Essentials: secure configuration and security update management).
  3. Verify signatures and hashes independently: check code signing certificates and compare hashes with values published through a separate channel from the download itself.
  4. Restrict what ground-control and planning servers can reach: limit outbound connections and admin access so a rogue update has little room to call home or move sideways (Cyber Essentials: firewalls and user access control).
  5. If you ship software, protect your update channel: put it in scope for penetration testing, enforce phishing-resistant MFA on build, signing and hosting accounts, and log every publish event.
  6. Plan for the grounding decision: agree in advance who can suspend use of a supplier’s product, on what evidence, and how operations continue in the meantime.

Bottom line

A poisoned update for mission-planning software was enough to take a national military’s drone fleet out of service, even though it apparently never reached a single aircraft. For UK defence firms and their suppliers, the update server deserves the same scrutiny as the product. Customers should insist on evidence, not reassurance, when a vendor says the threat has been contained.

Sources

Related Posts