An Iran-linked hacker group called Handala on Friday claimed to have infiltrated the surveillance drones operated by the Federal Bureau of Investigation (FBI) and threatened to use those drones in a terrorist attack on World Cup soccer matches.
The SITE Intelligence Group relayed a statement by Handala claiming the group has been monitoring “every image and every suspect” seen by the FBI’s first-person view (FPV) drones “for months.”
“Better tighten your World Cup security, we don’t like some of those teams at all. Don’t forget: FPVs are everywhere; you never know when one might end up right in your team’s bus,” the hacker group said.
The statement was accompanied by sample images and videos that Handala said were extracted from the hacked drones, although SITE noted that some of this “proof” of the hack actually consisted of older public-domain videos taken by drones.
The FBI issued a statement on Sunday dismissing Handala’s claims as fabrications.
“The FBI is aware of claims circulating online that a foreign-linked hacking group accessed FBI unmanned aircraft systems and associated imagery. These claims are false,” the statement said.
“The FBI, alongside its federal, state, and local partners, remains fully postured to protect World Cup venues and events. We encourage the public to rely on official sources and to report suspicious activity to law enforcement,” the statement added.
Handala, also known as the “Handala Hack Team” or Handala Popular Resistance Front (HPRF) is a relatively recent addition to a cluster of online threat groups linked to Iran’s Ministry of Intelligence and Security (MOIS).
Iran has a long history of creating, retiring, and recycling different “personas” for its hacker groups. Handala, which is named after a Palestinian cartoon character created over four decades ago, has been among the most active of these personas in 2026.
The first communiques from the Handala Hack Team, which claims to be an independent “hacktivist” group opposed to Israel’s actions in Gaza, appeared in late 2023 – a few months after the terrorists of Hamas launched the Gaza War by massacring Israeli civilians. Members of the Handala group claim to have perpetrated physical terrorist attacks in Israel, in addition to cyber-espionage.
When ceasefire negotiations began between Iran and the United States, Handala published a statement that said its “cyber war did not begin with the military conflict, and it will not end with any military ceasefire.”
“According to the orders from the highest leadership of the Resistance Axis, we have currently postponed overt confrontation with the United States, but the world already knows our capability to penetrate and strike at the very core of American infrastructure,” the group said.
In July 2025, Handala claimed it was able to penetrate the internal communications of Iran International, the internationally based Iranian dissident media group. The hackers released stolen personal information, photos, and documents from Iran International’s servers.
In March 2026, Handala claimed credit for hacking the personal email account of FBI Director Kash Patel. As with the Iran International hack, the group posted photos that it claimed were extracted from Patel’s accounts as proof of the hack – although, as with the new FBI drone hack, security experts said some of the material exposed by Handala was old and might have been recycled from earlier data leaks.
“The so-called ‘impenetrable’ systems of the FBI were brought to their knees within hours by our team. This is the security that the US government boasts about?! This is the cyber giant that thinks threats and bribes can silence the voice of resistance?!” Handala boasted when announcing the Patel hack.
Last week, Handala claimed it was able to breach the water utility systems of the California cities of Bakersfield, Visalia, and Chico. The cyberattack was ostensibly carried out in retaliation for U.S. airstrikes on reservoirs in Iran.
“Only two days ago, [Trump] destroyed the water sources of the oppressed people of Sirik with multi-million-dollar rockets, inflicting forced thirst and suffering in 50-degree [122°F] heat. Today, retribution has reached the heart of America,” the hacker group said in its claim of responsibility for the attack.
Handala exposed some data allegedly pilfered from the targeted systems as proof of its attack but said it could have done much worse.
“We could have easily cut off the water to American cities just as your foolish president did, but our path and our school are different,” the statement said.
“This is not 2010, when you could attack with Stuxnet and suffer no consequences. Today, every assault will be met within hours by a far more devastating blow to your own infrastructure,” the group added, referring to the landmark Stuxnet cyberattack credited with disrupting Iran’s nuclear weapons program.
