Handala Claims an FBI Drone Hack and a World Cup Threat. The Proof Fell Apart Fast.

An Iran-linked hacker group called Handala claims it breached FBI first-person view (FPV) drones and used that access to threaten teams at the 2026 FIFA World Cup, which opened June 11 across the United States, Mexico, and Canada. The SITE Intelligence Group, which monitors extremist and state-linked propaganda, published the group’s statement on June 12. Handala said it had access “for months” to “every image and every suspect” captured by FBI FPV drones, and that those aircraft ran facial recognition and license plate screening for counterterrorism.

The threat was blunt. “Better tighten your World Cup security, we don’t like some of those teams at all. Don’t forget: FPVs are everywhere; you never know when one might end up right in your team’s bus,” Handala said in the statement quoted by SITE.

Then the evidence collapsed. Handala posted photos and footage it said came from the hacked drones, and SITE disputed that claim outright, identifying at least one clip as recycled marketing material that had nothing to do with the FBI. The State Department has a standing reward of up to $10 million for information identifying members of the group, which the Justice Department describes as a front for Iran’s Ministry of Intelligence and Security.

SITE Traced Handala’s Hack Footage to a 2024 Police Tornado Survey

SITE found that one video Handala presented as hacked FBI drone footage was in fact produced by a drone software platform in December 2024 to promote a U.S. police department’s use of its technology for surveying tornado damage. The clip was promotional content, not a counterterrorism feed, and predated the World Cup by more than a year.

The description matches a December 2024 case study published by DroneDeploy that featured the Omaha Police Department mapping damage from the April 2024 Elkhorn, Nebraska EF4 tornado. In that operation, Sergeant Tyler Friend and his team flew DJI and Autel aircraft to capture more than 17,000 images, then stitched them into a public orthomosaic to guide FEMA recovery work. The CBS and AFP wire story does not name the company, so the attribution here is an inference based on matching details, but it is the only widely documented December 2024 video that fits every element SITE described.

The recycled clip matters because it converts a scary headline into a verification problem. A drone disaster-response demo, lifted and relabeled as a covert FBI surveillance breach, is exactly the kind of low-cost forgery that travels faster than the correction.

Handala Operates as an Iranian Front With a Record of Inflated Claims

Handala is not an independent hacktivist crew. The Justice Department says its domains were controlled by Iran’s Ministry of Intelligence and Security and used for “attempted psychological operations” against adversaries of the regime, part of an operational playbook the FBI describes as “faketivist” campaigns built on stolen data. Security researchers have repeatedly documented the group inflating or fabricating the scope of its attacks. That pattern is the reason to read the World Cup threat with caution.

The group surfaced in December 2023 after the October 7 Hamas attacks and ramped up against U.S. targets after the U.S.-Israeli strikes on Tehran on February 28, 2026, which killed Supreme Leader Ali Khamenei and triggered the wider Middle East war. In March 2026, Handala claimed it hacked the personal email of FBI Director Kash Patel and published more than 300 emails, photos, and a resume, with correspondence dating between 2010 and 2019. A Justice Department official told Reuters the material appeared authentic. Around the same time, the department seized four Handala-linked domains, and the State Department’s Rewards for Justice program reissued its $10 million offer naming the group directly.

Researchers who track the group are consistent on the method. Ari Ben Am of the Foundation for Defense of Democracies told Cybersecurity Dive that “Iranian actors routinely exaggerate the impact of their intrusions,” adding old leaked data into fresh claims and passing off social media material as stolen files. Handala has also done real damage: the Foundation for Defense of Democracies reported that its March 2026 attack on Michigan-based medical device maker Stryker “reportedly deleted data from over 200,000 employee devices across 79 countries” and “forced some hospitals to postpone surgeries.” The analyst posture is to treat each claim as unverified until proven rather than dismissing the group as harmless.

The FBI Is Flying Drones and Hunting Them at the Same Venues

The FBI is running its own drones around World Cup stadiums to spot unauthorized aircraft while simultaneously standing up counter-drone teams to find and disable hostile ones. That dual role is real, and Handala’s claim tries to weaponize it by suggesting the bureau’s own surveillance tools have been turned against the public they protect.

The actual program is documented. The bureau is fielding roughly 60 specially trained state and local officers across 11 U.S. host cities, drawn from 30 jurisdictions, taking direct command of counter-drone operations in three of them while Department of Homeland Security components cover the rest. The capability was built at the FBI’s National Counter-UAS Training Center at Redstone Arsenal in Huntsville, Alabama. In a May demonstration at Huntsville’s Joe Davis Stadium, operators seized control of a target drone from about 1.6 km (a mile) away without firing a shot. Much of the equipment flows from a $500 million federal counter-drone program, whose first $250 million tranche FEMA distributed to the 11 World Cup host states plus the National Capital Region.

The threat environment underneath the propaganda is genuine, even as officials downplay anything specific. “There are no specific credible threats, but there are always risks, and so again we are remaining vigilant to mitigate against those risks,” FBI co-deputy director Andrew Bailey said at a May 29 media briefing at the FBI’s Miami field office. NYPD Commissioner Jessica Tisch put the worry more plainly: “The war in Ukraine has become a real-world testing ground for drone technology, and if there is one threat that keeps me up at night, it is from drones.”

FAA No Drone Zones Carry $100,000 Fines Across 11 Host Cities

The Federal Aviation Administration has designated every World Cup stadium and surrounding event space a No Drone Zone, with temporary flight restrictions barring drone operations within 3 nautical miles of host stadiums and up to 3,000 feet on match days. Fan events and team base camps carry tighter rings, and enforcement runs through July 21.

The penalties are steep. “This includes civil penalties, criminal fines up to $100,000 and up to a year in prison, and a seizure of your drone. And there will be no grace period for violators,” FBI Miami Special Agent in Charge Brett Skiles said. Federal law enforcement is authorized to intercept and seize drones inside the restricted airspace. The rings extend well beyond the stadiums, with more than 100 separate restrictions layered over team hotels and training camps in cities that are not hosting a single match, a footprint Part 107 commercial operators have already run into.

Enforcement is not theoretical. FBI Atlanta seized three drones on June 11 for violating World Cup flight restrictions, with the bureau warning that operators face fines up to $100,000 and criminal charges on top of losing their drones. “Flying in those areas isn’t just dangerous, it’s a federal crime,” FBI Atlanta Special Agent in Charge Marlo Graham said in comments reported by Nexstar. The Atlanta seizures are the real drone story at this World Cup, and they make Handala’s fictional breach look small by comparison.

DroneXL’s Take

I have been tracking this counter-drone buildout for DroneXL since the $500 million domestic counter-drone initiative landed in October 2025, through the FEMA grants, the FBI training center graduating its first class, the FAA No Drone Zone push, and the base camp TFRs that grounded working pilots hundreds of miles from any match. This Handala story sits in a different bucket than any of those, and it is worth being precise about why.

A fabricated hack claim still does damage even when it is debunked the same day. The harm is not a downed drone or a breached database. It is the erosion of public trust in legitimate public safety drone programs, the same programs I have spent years covering through the FCC Covered List fight and the FAA stadium TFR expansions. When a recycled tornado-survey video from a real police mapping mission gets relabeled as covert FBI spying, it taints the entire category of drones-for-good in the public mind, and it hands ammunition to the people who already believe every drone overhead is watching them.

The irony is sharp. The FBI is operating drones and hunting drones at the same venues, and Iran’s information operators are trying to collapse that distinction on purpose. The honest counterweight is verification done in public, the way SITE handled this one by tracing the clip back to its 2024 source.

Watch two real dates. The World Cup runs through the July 19 final at MetLife Stadium, which is the live test of whether the counter-drone plumbing holds across 39 days and 104 matches. And the FAA’s Section 2209 rulemaking, which would govern permanent airspace restrictions over fixed sites, is in its public comment window through July 6. Whether the security momentum from this tournament hardens into permanent restrictions on ordinary commercial pilots is an open question, not a prediction, and it is the one I will be watching after the trophy is lifted.

Source: CBS News. Additional sources: SITE Intelligence Group, U.S. Department of Justice, U.S. Department of State Rewards for Justice, Federal Aviation Administration, FBI Atlanta, DroneDeploy, Foundation for Defense of Democracies, Cybersecurity Dive.

DroneXL uses automated tools to support research and source retrieval. All reporting and editorial perspectives are by Haye Kesteloo.