# Quantum Systems QBase ground-control software update reportedly malware-laden; Bundeswehr drones grounded as precaution

> Quantum Systems says it detected a cyberattack at the end of October 2026. Der Spiegel, citing unnamed sources, reported that malware was found in an update to QBase, the company's ground-control software, and that the update reached servers of the German military and other customers without directly infecting the drones. The Bundeswehr grounded its Quantum Systems drones as a precaution; the vendor says the threat was contained and its fleet is operating normally.

- **Published:** 2026-11-13T13:36:19Z
- **Last reviewed:** 2026-11-13T13:36:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5965
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5965.png
- **ID:** TL-2026-5965
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (1 shown free below)

## Description

Quantum Systems, a German drone manufacturer founded in 2015 that supplies the Bundeswehr and Ukraine, said it detected a cyberattack at the end of October 2026 and reported it to the relevant authorities. In a statement posted on Thursday 12 November 2026 the company said the threat was contained thanks to the swift response of its IT and security teams, that there is no risk in operating its unmanned systems for end users and operators, and that other European defense firms and suppliers to Ukraine's military have faced persistent cyberattacks for years.

Per Der Spiegel (citing unnamed sources, as relayed by The Register on 2026-11-13), the Bundeswehr grounded its Quantum Systems drones after malware was detected in an update to QBase, the company's ground-control software used by operators to plan missions, monitor flights and process data from the ground. The malicious update reportedly reached servers belonging to the German military and other customers, but did not directly infect the drones themselves. The Bundeswehr grounding was precautionary and has since been lifted. Quantum Systems told Reuters that the Bundeswehr was the only customer to ground its systems and that the fleet is operating normally around the globe. Germany's defense ministry declined to comment.

Evidence limits: this record rests on a single secondary article (The Register) that relays Der Spiegel and Reuters reporting; the vendor statement page could not be retrieved directly (HTTP 403) and independent searches found no corroborating coverage at the time of research. No malware name or family, threat actor, attack vector, affected QBase versions, IOCs or CVEs have been published. Severity, status and the MITRE mapping are analyst assessments based on the reported malicious-update scenario, not source-stated values. Context: in October 2026 the German Chancellor announced funding for several tens of thousands of the company's interceptor drones, and in July 2026 the company announced a $1.2 billion Series D round, which makes it a high-value defense supply-chain target.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1608.001 Upload Malware

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**QBase Updater or Ground-Control Process Spawning Shell or Script Interpreter (TL-2026-5965)** (`TL-2026-5965-SPL-001`)

Detects a QBase ground-control software process (or its updater) launching a command shell, script host or living-off-the-land binary. A trojanized QBase update (T1195.002, TL-2026-5965; Der Spiegel reported malware in a QBase update reaching German military and customer servers) would need to execute payloads on the ground-control server, and legitimate QBase has little reason to spawn interpreters. Evidence note: no hashes, domains or IPs have been published, so this is a behavioural hunt keyed on QBase process lineage; confirm real QBase install paths and binary names in your environment.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1059.001, T1059.003
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_security
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (ParentImage="*\\qbase*" OR ParentCommandLine="*qbase*") Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\pwsh.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe", "*\\rundll32.exe", "*\\regsvr32.exe", "*\\certutil.exe", "*\\bitsadmin.exe") | stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as child_cmdlines values(ParentImage) as qbase_parents by Computer User | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (InitiatingProcessFileName contains "qbase" or InitiatingProcessFolderPath contains "qbase")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
```

### Sigma

```yaml
title: QBase Process Spawning Shell or Script Interpreter
id: 3f1c7a52-8d4e-4b9a-9c61-2a5e7d0b1f01
status: experimental
description: Detects QBase ground-control software or its updater spawning a shell, script host or LOLBin, consistent with a trojanized QBase update executing a payload (TL-2026-5965).
references:
    - https://www.theregister.com/security/2026/11/13/quantum-systems-drones-back-in-the-air-after-malware-scare/5309658
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains: '\qbase'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Vendor-supported QBase post-install scripts or diagnostics launching cmd.exe
    - Administrators launching a shell from within the QBase application
level: high

```

**Known false positives:**

- Legitimate QBase installer or post-install scripts that invoke cmd.exe or PowerShell
- Operators running diagnostics from inside the QBase application

**Tuning notes:** Baseline QBase installer behaviour during a known-good update in a test environment, then allowlist expected child command lines. Adjust the ParentImage wildcard to the actual QBase binary names. Enable Sysmon EventCode 1 on ground-control servers.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- QBase Process Dropping Executable or Script Content into Writable Locations (TL-2026-5965) (locked: unlock with TL Creds)
- QBase Process Writing Autorun or Service Registry Keys (TL-2026-5965) (locked: unlock with TL Creds)
- QBase Process Connecting to Internal Admin Ports for Lateral Movement (TL-2026-5965) (locked: unlock with TL Creds)
- QBase Updater Contacting Non-Vendor Host (TL-2026-5965) (locked: unlock with TL Creds)
- QBase Process Running Host and Network Discovery Commands (TL-2026-5965) (locked: unlock with TL Creds)
- QBase Process DNS Queries to Unusual or High-Volume Domains (TL-2026-5965) (locked: unlock with TL Creds)
- QBase Process Creating Scheduled Task or Service for Persistence (TL-2026-5965) (locked: unlock with TL Creds)
- QBase Process Beaconing to Non-Vendor Public Host (TL-2026-5965) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 11)

Defanged, TLP:CLEAR.

- URL: `hxxps://www[.]spiegel[.]de/politik/massiver-cyberangriff-auf-drohnenhersteller-quantum-systems-a-354b0289-2281-4af6-a532-ee03b45d8b30`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Quantum Systems drones back in the air after malware scare (The Register, Connor Jones)](https://www.theregister.com/security/2026/11/13/quantum-systems-drones-back-in-the-air-after-malware-scare/5309658)
- [Quantum Systems statement: Cyberattack defeated](https://quantum-systems.com/news/cyberattack-defeated/)
- [The Register: Ukraine unveils native jet-powered drone interceptor](https://www.theregister.com/offbeat/2026/08/25/ukraine-unveils-native-jet-powered-drone-interceptor/5292081)
- [Germany funds Quantum Systems interceptor drones for Ukraine (Munich Startup)](https://www.munich-startup.de/en/news/germany-funds-quantum-systems-interceptor-drones-for-ukraine)
- [New drone training certified for the Bundeswehr (ESUT)](https://esut.de/2024/12/meldungen/55467/neue-drohnenausbildung-fuer-die-bundeswehr-zertifiziert/)
- [Der Spiegel: Massiver Cyberangriff auf Drohnenhersteller Quantum Systems](https://www.spiegel.de/politik/massiver-cyberangriff-auf-drohnenhersteller-quantum-systems-a-354b0289-2281-4af6-a532-ee03b45d8b30)
- [Reuters: Quantum Systems says grounded German military drones flying again](https://www.reuters.com/business/aerospace-defense/quantum-systems-says-grounded-german-military-drones-flying-again-after-2026-11-13/)
- [QBase Creates Platform Lock-in for Drone Fleets (Sacra)](https://sacra.com/chat/h/50f896c5-a35f-4769-9167-d99459d49566/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5965