Cyberattack via Malicious Update Hit German Defense Drone Maker Quantum Systems

German drone maker Quantum Systems confirmed on Tuesday that hostile actors breached its update distribution server in late October, disrupting military drone operations and prompting the German armed forces to ground the affected systems as a precaution.

The Munich-based defense technology company detected the incident in late October and identified it as part of an active cyberattack by what it called "hostile actors." Quantum Systems said it responded quickly, worked with relevant authorities to resolve the issue, and ensured its unmanned systems could safely resume operations.

What was compromised?

According to Der Spiegel and the Financial Times, citing internal sources, attackers planted a malicious update file for QBase, Quantum Systems' ground-control and mission-planning software. The point of compromise was the vendor's update distribution server. Der Spiegel identified the Vector reconnaissance drone, known as Falke in German military service, as one of the aircraft whose missions are planned with QBase. The unscheduled update delivered to customers raised alarms within the company, but it remains unclear how many customers actually installed the file.

The company believes it was targeted because of its recent announcement of support for Ukraine. In October, Germany announced funding to build tens of thousands of Quantum Systems interceptor drones in Ukraine for Ukrainian forces.

What did the company say?

"The European defense industry has been facing persistent cyberattacks for years," Quantum Systems stated, without attributing the attack to a specific actor. "Companies at the forefront of supporting Ukraine are being targeted precisely because our work is critically relevant to customers' security." The company said it is working closely with state authorities to investigate the intrusion.

How did Germany respond?

Additional reports claim the German armed forces grounded Quantum Systems drones as a precaution and excluded the company's systems from a recent military exercise. The response reportedly involves three agencies: the military counterintelligence service (MAD), the domestic intelligence service (BfV), and the federal cybersecurity agency (BSI). No agency has publicly detailed the scope of the compromise.

Is this part of a wider pattern?

The Quantum Systems breach follows a similar incident in July. Australian drone manufacturer CubePilot, which also openly supports Ukraine, suffered a DNS hijacking attack (redirecting domain lookups to attacker-controlled servers) that caused severe operational disruption. Such hijacking could, among other things, deliver malicious updates to downstream users of CubePilot's drone systems, though that level of compromise was never confirmed.

Quantum Systems builds reconnaissance and interceptor drones, other unmanned systems, and the software that controls them. Its drones are in service with Germany's military.