My ideas spoilered, to let you all come up with your own:
The direct control method has lots of potential weak points - the operators, the ground control station, the network to reach the satellite uplink, and the radio to and from the satellite. I would hope there's end-to-end cryptographic verification on these signals, but we can't really count on it, or on it being done well. Assuming there is, though, that leaves just the first two options - turn one of the operators, or hijack the computers they use to send commands. Given the stories about some of these stations having a persistent virus infection, and apparent Internet connectivity, the last one seems plausible.
Assuming the control systems and network weren't compromised, let's turn to the backup. They would need to somehow cut off the direct controls. Satellite communications are probably somewhat easier to jam than modern terrestrial radio, given the limited available spectrum and the more conservative hardware that we can afford to put in space. So, find the right satellite and frequency, blast a signal that looks enough like the real thing to cause interference, and that's done. How do we misdirect the backup plans?
It looks like some researchers at a Chinese military academy have published work on forging GPS signals. That seems like a fruitful path - slowly drift the craft off-track, perhaps systematically increasing its apparent speed to fool any inertial guidance into thinking it's slow, and has actually run certain legs of the route sooner than it really has. Eventually, this needs to steer it to an appropriate landing field. Suppose they've watched these drones fly a consistent pattern a few times. That means that the fake signals can mostly be prepared in advance, rather than fully synthesized on the fly. Does that all seem feasible?