top of page


April 2021 | CTG CENTCOM Team

The Counterterrorism Group (CTG) is issuing a FLASH ALERT for the recent attack on the Natanz nuclear facility. The current CTG threat matrix indicates that there is a HIGH PROBABILITY that Iran will use this to push their agenda to reinstate the 2015 nuclear deal. Furthermore, there is a HIGH PROBABILITY that Iran will take action against Israel who is believed to be behind the attack. This assessment is also based on the growing tensions between the two countries and the increased number of attacks that have occurred in the past few months. On April 13, 2021, just two days after the Natanz attack, an Israel-owned vessel was attacked off the United Arab Emirates (UAE) coast, and while there is no confirmation as to who the perpetrator was, it is likely that this was Iranian retaliation for the nuclear facility incident.

The Natanz nuclear facility is the centerpiece of Iran’s nuclear program. It is located in the desert in the central province of Isfahan. On July 2, 2020, there was a fire in the facility that was believed to be caused by a cyber attack. While this was cited many times and though it could have been carried out by Israel, there was a lack of evidence to corroborate the suspicions.[1] Attacks on Natanz date back to 2010 with the insertion of the Stuxnet worm, a piece of malware developed by Israel and the US to target Iranian facilities.

Location of the Natanz Nuclear Facility [2]

On April 11, 2021, an electrical blackout struck Natanz. The origin of the attack does not appear to be cyber in nature but rather in the form of an explosion which targeted the internal power unit of the facility which supplies the centrifuges and enrichment process.[3] Akbar Salehi, the head of the Atomic Energy Organization of Iran, has since come out and stated that Iran has every right to take action against the perpetrators in light of what he deemed “nuclear terrorism.”[4] The attack came a day after the Iranian government said it was launching more than 150 new uranium enrichment centrifuges in their underground facilities.[5] Though not officially confirmed, American and Israeli intelligence agencies who had reportedly been briefed on the operation acknowledged Israel played a significant role in conducting the attack and that it could deeply affect Iran’s ability to enrich uranium.[6] Mohammad Javad Zarif, Iran's Foreign Minister, said his country would "take revenge" for the attack, implicitly blaming Israel.[7] Iran's Nour News agency, which is affiliated with the Supreme National Security Council, cited an intelligence ministry source as saying the “perpetrator" had been identified and an operation was underway to arrest them.[8] State TV named the suspect as Reza Karimi, an Iranian man from the city of Kashan who had allegedly fled the country.[9]

With more specific regard to the talks between Washington DC and Tehran, the attack could lead to any two scenarios. Ultimately, Iran will likely navigate the line between communicating to Israel that attacks cannot go unpunished all the while refraining from making Joint Comprehensive Plan of Action (JCPOA) talks unsalvageable. The first scenario could severely derail any prospects of achieving a new compromise if the attack forces Iran further away from a willingness to engage in diplomacy and onto a path of violence. That said, Iran has shown itself unproportional in its retaliation against attacks on its soil. Responses to the killing of General Soleimani were not of the same magnitude as the assassination, nor was the response to the killing of top nuclear scientist Mohsen Fakhrizadeh. The alternate scenario would see Iran become more prone to embracing a Biden-led outcome due to its inability to continue to contend with attacks on its installations. Paradoxically, this would produce an inverse outcome to the one desired by Israeli Prime Minister Benjamin Netanyahu, who has adamantly called for no deal at all.

The attack on the plant is said to set back Iran’s program nine months. However, not all the centrifuges were damaged and Iran plans to begin production next week.[10] Since, Iran has announced it will begin enriching uranium to 60% purity, which suggests it is doubling down on the first scenario elaborated above. This would make the material closer to 90% suitable for a nuclear bomb.[11] Iran and global powers were working on constructive talks to bring back the 2015 accord. This accord was undone since Iran had breached their limits on uranium since former President Trump imposed stricter sanctions. Iranian diplomats have used this attack as leverage to bring back the accords. Talks are scheduled to resume later in the week with France, Britain, and Germany in Vienna. However, President Biden has said Iran must resume all compliance mandated by the deal before they would rejoin the pact.[12][d][e][f] Iran’s announcement that it will begin enriching uranium to 60% purity is likely an effort to elevate its negotiating ability during the upcoming talks. Though Iran has verbally made the commitment to increase uranium enrichment there is no evidence to suggest this has already taken place. If not, this may enable Iran to both enter into negotiations from a position of increased power whilst also creating conditions to reach a mutually beneficial agreement for all parties once (and if) investigations prove that Iran had not reached such high levels of enrichment. However, the time it may take for negotiations and investigations to determine the true capacity of Iran’s nuclear capabilities could enable other Gulf nations to engage in nuclear development. This nuclear proliferation in the Gulf would be difficult to reverse and would create a considerable threat of mutually assured destruction in the CENTCOM region and beyond.

On April 13, 2021, only two days after the attack on the Natanz nuclear facility, an Israeli ship was hit by a missile near the UAE’s Fujairah port.[13] No casualties were reported and the ship was able to continue its journey with only minor damages. Israeli officials refused to comment on the incident, however, since Iran blamed Israel for the Natanz incident and claimed they would retaliate, there is strong indication that Iranian forces were behind the attack against the Israeli vessel. Additionally, as a result of recent escalations, it is highly likely that Iran will continue to conduct these somewhat isolated attacks against Israeli targets in the coming weeks. This is the third Israeli ship to be targeted in just two months, suggesting that Israeli vessels operating in the region are particularly vulnerable to Iranian attacks, especially those transiting the Arabian Sea, Gulf of Oman and Strait of Hormuz given their relative geographic proximity to Iran. Beyond maritime attacks, there is a likelihood that Iranian forces will also resort to their proxies in the Middle East to hit Israel, mainly those in Syria, Palestine, and Lebanon as they are all close to Israeli territory.

Approximate locations of the last three attacks against Israeli ships[14]

With JCPOA talks resuming this week, Iran finds itself in a difficult situation as it strives to lift some of the sanctions imposed by the United States and the other signatories, while also retaliating for the damages caused on its nuclear facility. Considering Israel's position towards reviving the JCPOA, which it sees as a major threat to its stability and security for failing to limit Iran’s development of nuclear weapons, it is likely that Israel will continue to attack Iran and work to prevent the United States from re-entering the JCPOA deal. This means that Iran will have to be more careful with its retaliations against Israel as it could affect negotiations with the JCPOA signatories, particularly the United States. Nonetheless, as seen by the April 13 attack against an Israeli ship, there is a strong probability that Iran will still be keen on sending a message to Israel that it will not tolerate any attacks, especially those against its nuclear facilities. However, any potential attacks will likely be of a lower magnitude so as to avoid disrupting JCPOA talks.


The Counterterrorism Group assesses that the current threat of targeted Iranian attacks against Israel is HIGH. Our analysis indicates that the probability of proportionality in retaliatory attacks is MEDIUM-LOW considering Iran’s interest in reviving the JCPOA deal, which would lift most sanctions imposed by the deal’s participants. We also assess that the risk to Israel-owned vessels from Iranian projectiles is also HIGH. Based on these threat assessments, CTG recommends Israel issue warnings to all their vessels operating close to Iranian territory and increase monitoring of attacks on Israeli ships. Additionally, we suggest the reinforcement of security measures at relevant sites, including embassies and other overseas offices. CTG, and in particular the CENTCOM Team, will continue to monitor the situation and anticipate any potential attacks against Israeli interests.

If any individuals are interested in learning more about security measures to protect their facilities and personnel, please contact The Counterterrorism Group (CTG) by Telephone 202-643-248 or email


[1] Fire causes damage at Iranian nuclear facility after possible ‘cyber sabotage’, Task and Purpose, July 2020,

[2]Natanz Nuclear Facility” by Google Maps

[4] Blackout HIts iran Nuclear Site in What Appears to Be Israeli Sabotage, The New York Times, April 2021,

[5] Incident at Iran’s Natanz facility a ‘terrorist action,’ nuclear chief says, Granthshala News, April 2021,

[6] Blackout HIts iran Nuclear Site in What Appears to Be Israeli Sabotage, The New York Times, April 2021,

[7] Iran Natanz nuclear site suffered major damage, official says, BBC News, April 2021,

[8] Ibid

[9] Iran names suspect in Natanz nuclear plant attack, says he fled country, The Times of Israel, April 2021,

[10] Natanz nuclear plant attack ‘will set back Iran’s programme by nine months’, The Guardian, April 2021,

[11] Iran to begin 60% uranium enrichment after nuclear site incident, Reuters, April 2021,

[14] Filipe Neves via Google Maps



bottom of page