Skip to navigation

Threat reportSupply ChainTL-2026-5965

Quantum Systems QBase ground-control software update reportedly malware-laden; Bundeswehr drones grounded as precaution

highMONITORING

Quantum Systems says it detected a cyberattack at the end of October 2026. Der Spiegel, citing unnamed sources, reported that malware was found in an update to QBase, the company's ground-control software, and that the update reached servers of the German military and other customers without directly infecting the drones.

Key facts

IdentifiersTL-2026-5965
SeverityHIGH
First disclosed
Affected productsQuantum Systems QBase ground-control software
MalwareUnnamed malware in QBase update
MITRE ATT&CK techniquesT1195.002 Compromise Software Supply Chain, T1199 Trusted Relationship, T1608.001 Upload Malware
MotivationUNKNOWN
Target sectorsdefense, government administration, military, aerospace
Target regionsEurope, germany, ukraine
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5965 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: QBase Updater or Ground-Control Process Spawning Shell or Script Interpreter (TL-2026-5965)

Detects a QBase ground-control software process (or its updater) launching a command shell, script host or living-off-the-land binary. A trojanized QBase update (T1195.002, TL-2026-5965; Der Spiegel reported malware in a QBase update reaching German military and customer servers) would need to execute payloads on the ground-control server, and legitimate QBase has little reason to spawn interpreters. Evidence note: no hashes, domains or IPs have been published, so this is a behavioural hunt keyed on QBase process lineage; confirm real QBase install paths and binary names in your environment.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1195.002, T1059.001, T1059.003
  • Data sources: sysmon, microsoft_defender_for_endpoint, windows_security
  • Severity: high
  • Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (ParentImage="*\\qbase*" OR ParentCommandLine="*qbase*") Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\pwsh.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe", "*\\rundll32.exe", "*\\regsvr32.exe", "*\\certutil.exe", "*\\bitsadmin.exe") | stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as child_cmdlines values(ParentImage) as qbase_parents by Computer User | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (InitiatingProcessFileName contains "qbase" or InitiatingProcessFolderPath contains "qbase")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256

Sigma

title: QBase Process Spawning Shell or Script Interpreter
id: 3f1c7a52-8d4e-4b9a-9c61-2a5e7d0b1f01
status: experimental
description: Detects QBase ground-control software or its updater spawning a shell, script host or LOLBin, consistent with a trojanized QBase update executing a payload (TL-2026-5965).
references:
    - https://www.theregister.com/security/2026/11/13/quantum-systems-drones-back-in-the-air-after-malware-scare/5309658
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains: '\qbase'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Vendor-supported QBase post-install scripts or diagnostics launching cmd.exe
    - Administrators launching a shell from within the QBase application
level: high

Known false positives:

  • Legitimate QBase installer or post-install scripts that invoke cmd.exe or PowerShell
  • Operators running diagnostics from inside the QBase application

Tuning notes: Baseline QBase installer behaviour during a known-good update in a test environment, then allowlist expected child command lines. Adjust the ParentImage wildcard to the actual QBase binary names. Enable Sysmon EventCode 1 on ground-control servers.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • QBase Process Dropping Executable or Script Content into Writable Locations (TL-2026-5965) · unlock with TL Creds
  • QBase Process Writing Autorun or Service Registry Keys (TL-2026-5965) · unlock with TL Creds
  • QBase Process Connecting to Internal Admin Ports for Lateral Movement (TL-2026-5965) · unlock with TL Creds
  • QBase Updater Contacting Non-Vendor Host (TL-2026-5965) · unlock with TL Creds
  • QBase Process Running Host and Network Discovery Commands (TL-2026-5965) · unlock with TL Creds
  • QBase Process DNS Queries to Unusual or High-Volume Domains (TL-2026-5965) · unlock with TL Creds
  • QBase Process Creating Scheduled Task or Service for Persistence (TL-2026-5965) · unlock with TL Creds
  • QBase Process Beaconing to Non-Vendor Public Host (TL-2026-5965) · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5965.

Sample indicators (1 of 11)

  • URL: hxxps://www[.]spiegel[.]de/politik/massiver-cyberangriff-auf-drohnenhersteller-quantum-systems-a-354b0289-2281-4af6-a532-ee03b45d8b30

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

11 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

The Bundeswehr grounded its Quantum Systems drones as a precaution; the vendor says the threat was contained and its fleet is operating normally.

Quantum Systems, a German drone manufacturer founded in 2015 that supplies the Bundeswehr and Ukraine, said it detected a cyberattack at the end of October 2026 and reported it to the relevant authorities. In a statement posted on Thursday 12 November 2026 the company said the threat was contained thanks to the swift response of its IT and security teams, that there is no risk in operating its unmanned systems for end users and operators, and that other European defense firms and suppliers to Ukraine's military have faced persistent cyberattacks for years.

Per Der Spiegel (citing unnamed sources, as relayed by The Register on 2026-11-13), the Bundeswehr grounded its Quantum Systems drones after malware was detected in an update to QBase, the company's ground-control software used by operators to plan missions, monitor flights and process data from the ground. The malicious update reportedly reached servers belonging to the German military and other customers, but did not directly infect the drones themselves. The Bundeswehr grounding was precautionary and has since been lifted. Quantum Systems told Reuters that the Bundeswehr was the only customer to ground its systems and that the fleet is operating normally around the globe. Germany's defense ministry declined to comment.

Evidence limits: this record rests on a single secondary article (The Register) that relays Der Spiegel and Reuters reporting; the vendor statement page could not be retrieved directly (HTTP 403) and independent searches found no corroborating coverage at the time of research. No malware name or family, threat actor, attack vector, affected QBase versions, IOCs or CVEs have been published. Severity, status and the MITRE mapping are analyst assessments based on the reported malicious-update scenario, not source-stated values. Context: in October 2026 the German Chancellor announced funding for several tens of thousands of the company's interceptor drones, and in July 2026 the company announced a $1.2 billion Series D round, which makes it a high-value defense supply-chain target.

MITRE ATT&CK techniques by tactic:

Initial Access

T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Resource Development

T1608.001 Upload Malware

Remediation

Patches

  • No CVE or patch identifier published; use the vendor-supplied clean QBase release once confirmed by Quantum Systems

Immediate actions

  • Customers running QBase: confirm with Quantum Systems which QBase update(s) were affected and verify the installed build against vendor-provided hashes
  • Isolate and review servers that received a QBase update in late October 2026 and hunt for unexpected processes, persistence and outbound connections
  • Follow vendor and national-authority guidance before returning QBase hosts to operational use

Workarounds

  • Hold automatic QBase updates until the vendor confirms integrity of the update channel

Longer-term hardening

  • Require signed, hash-verified software updates and verify signatures out-of-band before deployment to mission systems
  • Stage vendor updates in an isolated test environment before production rollout
  • Segment ground-control servers from drone data links and enterprise networks and restrict their outbound traffic

Affected and fixed versions

  • Quantum Systems — QBase ground-control software
    Vulnerable versions: Update distributed around end of October 2026 (specific version not published)

Timeline

  • Quantum Systems announced a $1.2 billion Series D round valuing it at around $8 billion (July 2026; exact day not stated in source).
  • German Chancellor Friedrich Merz announced funding for several tens of thousands of Quantum Systems interceptor drones in a winter aid package (October 2026; exact day not stated in source).
  • Quantum Systems says it detected a cyberattack at the end of October 2026 and reported it to the relevant authorities (exact day not stated).
  • Bundeswehr grounded its Quantum Systems drones as a precaution after reported malware in a QBase update (date approximate; exact grounding and lifting dates not stated in source).
  • Quantum Systems posted a statement saying the threat was contained and that there is no risk in operating its unmanned systems.
  • The Register and Reuters reported the drones were flying again after the precautionary grounding was lifted; Der Spiegel (citing unnamed sources) had reported malware in a QBase update reaching German military and other customer servers.

Sources cited

Further reading

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats