A cyberattack disrupted the German maker of drones flown by Germany’s military

In late October, Quantum Systems found that unknown attackers had gotten into its networks and planted malware on an internal server, disguised as an update for Qbase, the mission-planning software that goes with its Vector reconnaissance drone. The Bundeswehr, which flies the Vector under the name Falke, then grounded the drones it buys from the company as a precaution, and the manufacturer missed a recent military exercise. Reports on Nov. 13 say the aircraft are flying again, though Germany’s Defence Ministry has not confirmed it.

Read next on Morning Overview: A $1 billion gas plant planned for Superior, Wisconsin, has been abandoned

The company, based in Gilching near Munich, has said little beyond describing an active attack by hostile actors and confirming that its security teams contained it.

A fake Qbase update on the company’s own server

According to WinFuture’s report, which draws on Der Spiegel, the malware was packaged as a Qbase update. The file reached Bundeswehr servers and those of other customers but was not passed on to the drones themselves, because it was caught during testing. Qbase is the ground-control layer: its Trinity Pro variant handles mission planning, flight monitoring and post-flight data analysis for the company’s surveying aircraft.

The Shattered.io account adds a caution. The claim that drones were untouched comes from media reports citing the Financial Times and Der Spiegel, and authorities have not confirmed it. No one has published how many customers installed the update, which versions were affected or any technical indicators that other operators could check.

The Bundeswehr’s precaution and the missed exercise

Germany’s armed forces responded by suspending flights of the Quantum Systems reconnaissance drones. The company says the Bundeswehr was the only customer to ground its systems, and it says end users face no risk when operating them. BleepingComputer’s report on Nov. 13 relays the company’s confirmation that it detected an incident in late October.

The practical cost, as WinFuture tells it, was a lost place at a military exercise: with the fleet on the ground, the manufacturer’s drones sat out a training event the armed forces had planned to use them in. Handelsblatt reported the disclosure in German as a massive cyberattack on the drone maker. According to the Gründerfreunde write-up, Quantum Systems said its fleet is operating worldwide, including in Germany and with the Bundeswehr, though the Defence Ministry has not confirmed that the grounding has ended.

The Gründerfreunde piece draws a lesson that applies beyond one firm: any software company with an update channel can be targeted this way, and it suggests signed updates, build servers kept separate from other systems, a prepared incident-reporting plan and cyber insurance as items worth reviewing. For a drone maker the exposure is sharper because the update server feeds ground stations that plan real flights for military customers. The company’s own account, that the file was stopped in testing before it reached any aircraft, is the main reason the episode ended in a grounding and not in something worse.

Three agencies and a suspected Ukraine motive

Der Spiegel reported that Germany’s Military Counterintelligence Service, the Federal Office for the Protection of the Constitution and the Federal Office for Information Security are all involved. None of the three has commented publicly, and no perpetrator has been named. The domestic intelligence service had already warned in July of elevated sabotage and espionage risks for Germany’s defense industry.

Quantum Systems says it believes it was targeted because of its recent announcement of support for Ukraine, a belief BleepingComputer attributes to the company itself. The firm, which the Gründerfreunde write-up says also drew a 150 million euro credit line from the European Investment Bank, KfW, Commerzbank and Deutsche Bank in February, has more than 200 employees in Ukraine and three joint ventures with Ukrainian companies building small attack drones and unmanned ground vehicles. ESUT reported on Mar. 23 that Ukraine’s security and defense forces had commissioned 15,000 interceptor drones, called STRILA, to be built with the Ukrainian manufacturer WIY Drones. Shattered.io’s author treats the Ukraine link as a consideration, not evidence of who was behind the intrusion.

The company is also a large target for money and politics. The Gründerfreunde cyberattack write-up reports a $1.2 billion Series D in July 2026 at a valuation of about 7 billion euros, led by Blackstone, Noteus, Airbus and Advent, with the federal investment arm KfW Capital taking part. It also says Chancellor Friedrich Merz announced in October that Germany will fund tens of thousands of interceptor drones for Ukraine, and that the Bundestag passed an intelligence-law reform on Nov. 13 in which Interior Minister Alexander Dobrindt cited hybrid threats.

Both the company and the reporting stop short of naming a state or a criminal group. Quantum Systems places the intrusion in a wider pattern of attacks on European defense firms that support Ukraine, according to the Gründerfreunde write-up, and the July warning from the domestic intelligence service gives that framing some official backing, but neither amounts to an attribution.

The unanswered question is attribution. With three agencies investigating, no named suspect and no published list of affected Qbase versions, the open items are how many customers ran the false update and whether the quick containment the company describes holds up when investigators publish their findings.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.