The German military grounded its Quantum Systems drones after attackers planted malware on the company’s update server and disguised it as a routine QBase update, according to Der Spiegel. QBase is the software that plans missions for the Vector reconnaissance drone. The Financial Times and Der Spiegel reported the grounding on November 12. Quantum Systems confirmed the attack that evening and said it had found the intrusion at the end of October.
The Bundeswehr flies the Vector under the name Falke. As we reported in December 2025, Germany planned to order 520 Falke systems for delivery in 2026.
Quantum Systems says its fleet is operational. Handelsblatt, citing the company, reports that the Bundeswehr declared a flight ban on the drones in Germany.
A Fake QBase Update Reached Bundeswehr Servers, Not The Drones
Der Spiegel reports that unknown attackers got into the Quantum Systems network and left malware on an internal update server, dressed up as a regular QBase update. The file reached servers at the Bundeswehr and at other customers. It did not reach the drones, and a check caught it.
The Financial Times account matches. A person familiar with the matter told the paper that Quantum Systems informed customers a malicious update file had gone out through the server that distributes QBase updates.
QBase is ground software. The FT calls it a ground control and mission planning system, and Quantum Systems’ page for QBase 3D, the version sold with its Trinity Pro survey drone, describes a Windows program for mission planning, flight monitoring and data post-processing. So the target was the software on the ground. No report says the file was installed on a mission-planning computer. The FT, Handelsblatt, dpa-AFX and the agency summaries of Der Spiegel’s paywalled report don’t say what the malware was built to do.
Quantum Systems Says Its Fleet Is Operational, And Berlin Won’t Comment
Germany’s defense ministry told the FT it does not discuss the readiness of military equipment, and it declined to comment to dpa-AFX. Quantum Systems said in its statement that its IT and security teams contained the threat with the authorities and that operating its drones carries no risk for users.
The accounts of the grounding differ on scope and timing. Two people familiar with the matter told the FT the Bundeswehr acted as a precaution, and that the decision kept Quantum Systems out of a recent exercise with the military. Der Spiegel says the Bundeswehr grounded the entire fleet last month, for a time. Handelsblatt, citing the company on Thursday evening, reports a Bundeswehr flight ban for Germany and says the fleet outside Germany remains in regular use.
The German armed forces did not immediately respond to the FT’s request for comment. In the reports published through Thursday night, nobody on the government side says on the record whether Germany’s Falkes are flying today.
Three German Agencies Are Investigating And No Attacker Is Named
Germany’s military counterintelligence service MAD, the domestic intelligence agency BfV and the federal IT security office BSI are all working the case, Der Spiegel reports. No attacker has been named. Quantum Systems refers only to hostile actors and has not said who it suspects.
The company said it was a target “precisely because our work is critically relevant to customers’ security.” It has more than 200 staff in Ukraine and three joint ventures with Ukrainian companies that build small attack drones, interceptors and ground vehicles, according to the FT, which says it isn’t clear whether those operations were affected. The BfV warned in July that Germany’s defense sector, and companies supporting Ukraine in particular, faced a higher risk of Russian cyber attacks, espionage and sabotage.
European drone makers have been targets before. In October 2025 we covered ESET’s finding that North Korea’s Lazarus group was going after European drone makers, and in August Poland’s ABW began investigating whether a fire at a WB Electronics plant that makes drone parts was sabotage. None of the reports we could read connects either case to this attack.
The FT lists Germany, Spain and the Netherlands as military customers and says Quantum Systems was valued at €7 billion (roughly $8 billion) in a funding round this year. None of the reports we could read names the other customers whose servers received the file.
Quantum Systems also sells in the US. Co-CEO Sven Kruck said in August that In-Q-Tel helped the company win CIA and FBI work. None of the reports mentions a US customer.
DroneXL’s Take
The drones were never the way in. My read is that the update server was chosen because a customer installs what its supplier sends, and a military customer does that inside a military network. The file was caught in a check and the Bundeswehr stopped flying, which is what a careful operator should do. The grounding still kept a Vector fleet that Germany is buying by the hundred out of the air, and it kept Quantum Systems out of an exercise.
I don’t think “no risk” from the company settles it. Quantum Systems says the fleet is operational, and Germany’s defense ministry won’t say whether it agrees. The company says customers outside Germany are still flying. The FT says customers were told a malicious file went out. They, and the public, should now get a plain account of which servers received it and what it was built to do.
Sources: Financial Times, Der Spiegel, Handelsblatt, dpa-AFX, Quantum Systems statement
DroneXL uses automated tools to support research and source retrieval. All reporting and editorial perspectives are by Haye Kesteloo. Read our editorial standards.
