Cyber Incident Victim: Natanz Nuclear Facility
Date:
Jun 2020
Location:
Iran
Summary
An explosion occurred at a nuclear facility in Iran, with the Homeland Cheetahs group claiming responsibility as dissident insiders. Iranian authorities denied sabotage but confirmed an incident, while satellite imagery corroborated fire damage. The event coincided with heightened cyber tensions, including alleged Israeli involvement in prior cyberattacks and ambiguous official statements. Multiple unexplained fires and explosions at strategic Iranian sites followed, suggesting a coordinated campaign impacting nuclear, economic, and infrastructure targets.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In the early hours of 30 June 2020, an unidentified group calling itself the Homeland Cheetahs sent a detailed email to journalists claiming responsibility for an attack on Iran's Natanz nuclear facility approximately two hours earlier, at 02:00 local time. The message asserted the group had detonated explosives at the site and included a propaganda video showcasing previous operations against Iranian strategic locations. Iranian authorities initially reported an "incident" at Natanz through the Atomic Energy Organisation, explicitly denying sabotage as the cause. NASA satellite imagery later confirmed visible fire damage at the facility at 02:06 local time, with the destruction patterns matching descriptions in the Homeland Cheetahs' communication. Iran's Supreme National Security Council acknowledged determining the cause but withheld details for security reasons. The attackers claimed membership within Iran's military and security dissident factions, though the sophistication of their prepared materials suggested advanced planning. This incident occurred amid a series of unexplained fires and explosions at sensitive Iranian sites between late June and early July 2020, including a liquid fuel production facility for ballistic missiles in Khojir (26 June), a deadly medical clinic explosion in Tehran (30 June), a Shiraz industrial fire (3 July), and an Ahwaz power plant blast (4 July).
The Natanz explosion coincided with heightened cyber hostilities between Iran and Israel, following Iran's alleged May 2020 cyber attack on Israel's water infrastructure and a retaliatory cyber strike on Iran's Shahid Rajaee port in May that disrupted 50% of Iran's maritime trade. While the Homeland Cheetahs presented themselves as domestic opposition, security analysts noted the possibility of foreign state actors using the group as cover, given naming conventions resembling known Iranian cyber groups like "Persian Cat." An unnamed Middle Eastern intelligence official cited by The New York Times attributed the Natanz blast to Israel, a claim met with non-denial by Israel's foreign minister who stated actions in Iran were "better left unsaid." Iranian officials avoided directly accusing Israel despite historical precedents of cyber conflict between the nations. The cumulative impact of these incidents targeted critical economic and military infrastructure, with observers like journalist Saeed Aganji suggesting they aimed to cripple Iran's economy and constrain its regional military financing. International nuclear inspectors remained barred from investigating related sites like Parchin, where suspected explosive tests had previously occurred.