An Iran-linked hacker group known as Handala has claimed to have breached FBI drones and issued a chilling threat targeting the ongoing 2026 FIFA World Cup, just days after the tournament kicked off across North America, a monitoring group reported on Friday.
The SITE Intelligence Group, which monitors jihadist and state-linked propaganda, published a statement from Handala claiming the group had accessed data from first-person view (FPV) drones used by the FBI “for months”. The hackers alleged the drones were equipped with facial recognition and license plate scanning technology deployed for counterterrorism operations, and claimed to have access to “every image and every suspect” captured by the aircraft.
“Better tighten your World Cup security, we don’t like some of those teams at all. Don’t forget: FPVs are everywhere; you never know when one might end up right in your team’s bus,” Handala said in the statement quoted by SITE.
The FBI is currently deploying drones around World Cup stadiums to protect against unauthorised aircraft. Civilian drone flights have been completely banned over US stadiums hosting matches, as well as over fan events related to the tournament co-hosted by the United States, Mexico and Canada. Training for local and state police on countering illegal drone activity at the World Cup is part of a $500 million federal funding package aimed at addressing the growing threat to sporting events.
Evidence quickly collapses under scrutiny
However, cybersecurity experts and intelligence monitors have cast significant doubt on the group’s claims. Handala published photos and footage that it said were taken from the hacked drones, but SITE disputed that claim outright.
One video presented by Handala as hacked FBI drone footage was in fact produced by a software platform in December 2024 to promote a US police department’s use of its technology for surveying tornado damage, SITE said. The clip — promotional content from a disaster-response demonstration — predated the World Cup by more than a year and had no connection to the FBI or counterterrorism surveillance.
The recycled evidence has led analysts to question the credibility of the group’s broader claims. Security researchers have repeatedly documented Handala inflating or fabricating the scope of its attacks, describing the group’s operational playbook as “faketivist” campaigns built on stolen or repurposed material.
A history of high-profile cyber operations
Handala is not an independent hacktivist crew. The US Department of Justice has identified the group as a front for Iran’s Ministry of Intelligence and Security (MOIS), describing Handala as one of several fictitious personas used by the ministry to claim responsibility for its cyberattacks while hiding its direct involvement in “influence operations and psychological scaremongering campaigns”.
The group first appeared publicly in December 2023 following the October 7 Hamas attacks on Israel, initially classified as a pro-Palestinian hacktivist group. Named after the Palestinian cartoon character Handala, a symbol of resistance and resilience, the group has since evolved into what cybersecurity firm Palo Alto Networks calls “the most prominent Iranian persona” in the hacktivist world.
Handala ramped up its activities against US targets after the US-Israeli strikes on Tehran on February 28, 2026, which killed Iranian Supreme Leader Ali Khamenei and triggered the wider Middle East war. In March 2026, the group claimed to have hacked the personal email account of FBI Director Kash Patel, publishing more than 300 emails, personal photos, and other material online spanning correspondence between 2010 and 2019. The FBI confirmed that “malicious actors” had targeted Patel’s personal email and said it had taken “all necessary steps to mitigate potential risks”.
The group has also been linked to destructive “wiper” attacks. In March 2026, Handala claimed responsibility for a massive cyberattack on US medical technology giant Stryker, stealing 51 terabytes of data and wiping over 200,000 systems, servers, and mobile devices. The group framed the operation as retaliation for the Minab school strike — a US airstrike that killed approximately 180 children in an Iranian elementary school on February 28. According to Check Point Research, which tracks the group as “Void Manticore,” it was the most significant wartime cyberattack on the United States.
More recently, on June 11, 2026, Handala claimed to have hacked California Water Service (Cal Water), one of the largest investor-owned water utilities in the US, publishing 5 gigabytes of data including customer personal information and administrative credentials. The hackers claimed they had the ability to disrupt water access but chose not to.
$10 million reward and heightened security
The US State Department’s “Rewards for Justice” program is offering up to $10 million for information leading to the identification of Handala’s members. The FBI has encouraged anyone with information related to malicious cyber activity to contact their local field office.
The Justice Department has previously warned of the potential for further cyberattacks by Iranian actors in the wake of the ongoing conflict. The warnings come as the World Cup, which opened on June 11, enters its first full week of matches across the United States.
While Handala’s World Cup threat has been met with skepticism, US authorities are not taking chances. The federal government has allocated $500 million to counter unauthorized drone activity at sporting events, and security officials continue to monitor the situation closely.
The FBI has not publicly confirmed or denied any breach of its drone systems, and multiple monitoring groups continue to assess the validity of Handala’s claims.
