[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f45q_MQUqm35Z8-UWWxe8W5knetunUM7UqMugjGPFVII":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"473b1bba-c42e-4c0d-b8bc-25f954e6d229","Quantum Systems drones back in the air after malware scare","quantum-systems-drones-back-in-the-air-after-malware-scare-7ac3b3","Germany's Bundeswehr lifted precautionary grounding after malicious update reportedly reached military servers","Germany's Bundeswehr grounded Quantum Systems drones after malware was detected in an update to QBase ground-control software at the end of October. The malicious update reached servers of the German military and other customers but did not directly infect the drones themselves. The Bundeswehr lifted the precautionary grounding after Quantum Systems' security teams contained the threat.","Quantum Systems drones grounded after malware found in QBase control software update.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F13\u002Fquantum-systems-drones-back-in-the-air-after-malware-scare\u002F5309658","https:\u002F\u002Fimage.theregister.com\u002F?imageId=246156&width=800","2026-11-13T13:14:00+00:00","2026-11-13T14:00:25.958508+00:00",7,[17,20,23,25],{"name":18,"type":19},"Quantum Systems","vendor",{"name":21,"type":22},"QBase","product",{"name":24,"type":22},"Quantum Systems drones",{"name":26,"type":19},"Bundeswehr","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":27,"icon":29,"name":30,"slug":31},null,"Supply Chain","supply-chain",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",[],[26,21,24],{"controls":51,"vendors":136},[52,81,107],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":82,"name":83,"problem":84,"products":85},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":103,"product_name":104,"url":105,"description":106},"incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"slug":108,"name":109,"problem":110,"products":111},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":147},"malware-hidden-in-drone-software-update-grounds-german-military-fleet","Malware Hidden in Drone Software Update Grounds German Military Fleet","A malicious update to Quantum Systems' QBase ground-control software reached the servers of Germany's Bundeswehr and other customers, forcing a precautionary grounding of the drone fleet. The root cause is a compromised software supply chain: attackers tampered with an update package before or during distribution, exploiting the implicit trust organizations place in vendor-supplied updates. This incident illustrates how a single point of failure in a supplier's update pipeline can cascade into operational disruption for multiple downstream customers, including sensitive military users. The fact that the malware reached servers but did not infect the drones themselves suggests network-level containment played a role, but the event underscores that update integrity verification and supplier security vetting are non-negotiable for critical systems.",[142,143,144,145,146],"NIS2 Article 21(2)(d)","NIS2 Article 21(2)(e)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SA-12: Supply Chain Protection","MITRE ATT&CK T1195.002: Compromise Software Supply Chain",{"NIS2 Article 21(2)(d)":148,"NIS2 Article 21(2)(e)":149,"NIST SP 800-53 SA-12: Supply Chain Protection":150,"MITRE ATT&CK T1195.002: Compromise Software Supply Chain":151,"CIS Control 2: Inventory and Control of Software Assets (v8)":152},"This point explicitly requires measures addressing security risks in the supply chain, including supplier relationships—directly applicable because the malware entered via a vendor-distributed software update.","This point requires security in acquisition, development, and maintenance including vulnerability handling, which covers the need to verify update integrity and secure the vendor's software release pipeline.","SA-12 requires organizations to apply safeguards against supply chain threats, including evaluating the integrity of software delivered by suppliers—precisely the control that would have caught the malicious update.","This technique describes adversaries tampering with software before delivery to customers, which matches the mechanism by which malware was inserted into the QBase update distributed to the Bundeswehr.","CIS Control 2 requires organizations to track authorized software and block unauthorized installations, which would have flagged the tampered update before it executed on military servers."]