The October cyberattack on Germany’s Quantum Systems, which develops drones for Ukraine, prompted the Bundeswehr to temporarily suspend its drones from military exercises. A single breach was enough to damage the manufacturer’s reputation. DefPulse examined how cyber threats affect the defense industry.
Quantum Systems: Attack via Drone Software
On November 12, 2026, German company Quantum Systems officially reported a cyberattack discovered in late October. According to the company, an internal investigation confirmed an active cyberattack by hostile actors. Quantum Systems’ information security team contained the threat in cooperation with government authorities and external specialists.
“Thanks to the prompt measures taken and the nature of the incident, there is no risk to end users and operators during the operation of Quantum Systems unmanned systems.”
The company did not disclose the details of the attack, did not name likely perpetrators, and did not report any specific affected customers.
At the same time, Financial Times published details of the incident on November 12, citing sources familiar with the situation.
According to the publication, the attackers exploited a server used to distribute software updates for QBase — a system designed for managing ground operations, mission planning, and drone data processing.
Hackers distributed a malicious file through the server, disguised as a routine update. The infrastructure of clients receiving software components from the manufacturer was put at risk.
As a precautionary measure, the Bundeswehr suspended the use of Quantum Systems drones in Germany and barred the company from participating in one of its military exercises. According to the FT, the decision was made following consultations with specialists familiar with the incident.
The greatest danger is that a user could potentially receive a malicious component not through a suspicious email or a third-party website, but through the familiar update mechanism from a trusted manufacturer.
Quantum Systems has more than 200 employees in Ukraine and three joint ventures with Ukrainian companies. They produce strike and interceptor drones as well as ground-based robotic systems. Whether the cyberattack affected Ukrainian enterprises and their operations is currently unknown.
Ukrainian Military Developers in Hackers’ Crosshairs
The Ukrainian defense sector is also facing targeted cyber operations. According to CERT-UA, in the first half of 2026, 3,309 cyber incidents were recorded and processed — 9.6% more than in the same period of the previous year. Among the sectors with the highest number of attacks were security and defense, government agencies, local authorities, and the energy sector.
One example is the activity of the UAC-0226 group, which CERT-UA tracks.
On October 26, the State Service of Special Communications published a warning about this group’s campaigns targeting, among others, developers of military innovations, military formations, and law enforcement agencies.
The primary tool was spear phishing. Attackers crafted emails with topics relevant to the specific audience: demining, drone production, court summons, or extracts from military registration records.
Malicious attachments were added to the messages. Once opened, remote access tools or data-stealing programs were launched on the victim’s computer.
CERT-UA describes the use of malware called GIFTEDCROOK, which collects browser data, including saved credentials and cookies.
ClickFix: The User Runs the Malware Themselves
Another example is the UAC-0277 campaign, which CERT-UA described on September 30, 2026.
Specialists discovered more than 100 compromised websites where attackers had planted malicious JavaScript code. Visitors were shown a fake Cloudflare verification page that imitated a standard procedure for confirming that the user is not a bot.
However, instead of a standard check, users were prompted to execute a command on their computer themselves. This triggered the download of the LUNEXSTEALER malware.
The technique has been named ClickFix. Its distinctive feature lies in exploiting the user’s trust in familiar interfaces and services: the person effectively performs the action that infects their device with their own hands.
Beyond Phishing: Methods Used Against the Defense Industry
Cyberattacks on military-tech companies are not limited to sending malicious emails. In 2026, state structures and affiliated groups continue to employ several main vectors of intrusion.
Supply Chain Compromise
Attackers target defense company contractors — software developers or component suppliers. The access gained potentially becomes an entry point into the systems of the primary manufacturer.
Spear Phishing and Social Engineering
Emails are disguised as official documents, government agency communications, partner requests, or job offers. In Ukraine, topics related to military registration, weapons production, and frontline needs are used.
Exploitation of Network Equipment
Routers, VPN gateways, and other devices with access to corporate networks also become entry points. In July 2026, CISA, NSA, and FBI warned of activity by Russian state-sponsored hackers exploiting vulnerable network devices in the defense-industrial sector. A joint advisory from US agencies emphasized the need to update equipment, strengthen authentication, and monitor for suspicious activity.
Infiltration via Remote Workers
A distinct threat comes from fictitious employees who gain legitimate access to corporate systems. In October 2026, the US Department of Justice announced a large-scale operation against a network of North Korean IT workers who used stolen identities to gain employment at American companies.
During the operation, the FBI conducted searches at more than 40 residences in Texas and seized approximately 187 computers and KVM devices. The scheme affected more than 70 companies.
Separately, on October 28, the US Department of Justice reported that an employee of an American defense contractor pleaded guilty to helping foreign individuals use stolen identities to obtain remote work and access to corporate systems.
What Are the Consequences of Cyberattacks for Weapons Manufacturers?
In ordinary business, a cyber incident most often results in financial or reputational losses. For the defense industry, the consequences are more serious and can affect military operations. The main risks include:
- Gaining unauthorized access to blueprints, technical documentation, targeting algorithms, software code, and test results.
- Impacts on corporate networks, production process management systems, and suppliers can lead to production line shutdowns, supply delays, or data loss.
- Attackers’ access to software, ground control stations, and operator accounts creates the risk of interference with unmanned systems operations.
- Compromise of accounting systems, inventory management, and contractor interaction can delay the delivery of equipment and components.
- Even without immediate interference, attackers can collect information about developments, partners, personnel, and enterprise structure over an extended period.
A separate risk is associated with operational technologies (OT) that control physical processes in production. On August 19, 2026, the US National Security Agency (NSA) reported the discovery of hacker activity involving reconnaissance and preparation of tools for attacks on Siemens S7 industrial programmable logic controllers. According to the US agency, exploitation of insufficiently protected controllers could lead to disruption of industrial processes, equipment damage, downtime, and safety incidents.
How Defense Companies Can Counter Cyberattacks
The approach is changing. Instead of attempting to build an impenetrable network perimeter, companies are advised to operate on the assumption that some element of their infrastructure may already be compromised.
One key principle is Zero Trust. It involves continuous verification of users, devices, and requests regardless of whether they are inside or outside the corporate network.
On October 8, 2026, NSA published dedicated guidance on applying Zero Trust to protect operational technologies in the US defense sector.
Access and Identity Control
Multi-factor authentication, separate accounts for employees and services, and restriction of access rights based on the principle of least privilege. The compromise of a single account must not open access to the entire infrastructure.
Network Segmentation
Corporate systems, development environments, production networks, and military equipment management systems must be separated. This complicates an attacker’s lateral movement between segments after the initial intrusion.
Software Supply Chain Protection
Manufacturers must verify the origin of software components, use digital signatures for updates, control dependencies, and secure development systems. The customer must be able to verify that a received software file genuinely originates from the manufacturer and has not been modified.
Monitoring and Response
Continuous analysis of network activity, access logs, and device behavior enables the detection of suspicious actions before they escalate into a large-scale incident.
Backup and Recovery
Isolated backups, tested recovery procedures, and pre-prepared response scenarios help minimize downtime after an attack.
Personnel and Contractor Vetting
Employee identity verification, remote access controls, audits of third-party accounts, and regular access rights reviews reduce the risk of insider infiltration.
Artificial Intelligence: A New Tool for Both Attack and Defense
Artificial intelligence is becoming another factor shaping cybersecurity in the defense sector.
Attackers use it to automate the preparation of phishing messages, adapt malware, and discover vulnerabilities. This allows them to prepare targeted campaigns more quickly and scale them without a proportional increase in human resources.
AI is also used for defense: analyzing network activity, detecting anomalies, automating responses, and identifying suspicious processes.
However, the Ukrainian examples of UAC-0226 and UAC-0277 demonstrate that conventional social engineering remains effective even without sophisticated exploits. Therefore, technological protection tools do not replace basic cyber hygiene and personnel training.
Two Can Play at This Game
In September 2026, the Main Directorate of Intelligence of Ukraine’s Ministry of Defense reported a successful cyber operation against the Moscow Institute of Thermal Technology — one of Russia’s key organizations in the field of missile weapons development.
According to the GUR, Ukrainian specialists obtained data on the corporation’s structure, its management, personnel, and current and prospective projects. These include developments for the Yars and Topol-M intercontinental ballistic missiles, the Bulava missile system, the Iskander-M tactical ballistic missile system, and the “Oreshnik” system. In addition, the corporation’s enterprises are working on components of military space infrastructure.
A separate result of the operation, according to Ukrainian intelligence, was the acquisition of personal data of 2,648 MIT employees, including management. The GUR stated that these materials could be used to weaken Russia’s military-industrial complex and to identify those responsible for war crimes.
