Quantum Systems Hack: Malicious Update Grounds German Drones
German defense firm Quantum Systems confirmed a late-October attack by 'hostile actors'. Reports say it came through a malicious update file for QBase, the software that plans its drone missions.
⚡ Why it matters
A compromised vendor update server means customers can install malware while believing it is an official update, a serious risk for military and other critical systems.
Quantum Systems, a German maker of reconnaissance and interceptor drones, said it spotted an incident in late October, part of an ongoing attack it blamed on hostile actors. The company says it worked with authorities so its unmanned systems could safely resume operations. It believes it was targeted for its public support of Ukraine but did not name an attacker.
How it happened
BleepingComputer, citing Der Spiegel and the Financial Times, reports that the intrusion came through a malicious update file for QBase, the company's ground-control and mission-planning software. That points to a compromised update distribution server, a classic supply chain attack.
QBase is used to plan missions for the Vector reconnaissance drone, called Falke in German service. Reports say the German military grounded the company's drones as a precaution and dropped them from an exercise, with military counterintelligence (MAD), the BfV and the BSI involved in the response. It is not yet known how many customers installed the update.
Lessons for organizations
- Never install an unscheduled update without verifying its digital signature and origin.
- Route updates for sensitive systems through a test environment instead of applying them directly.
- Ask vendors how they protect update servers and sign their packages.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.