Medusa Ransomware Activity in the UAE
Medusa has claimed 5 organisations in the United Arab Emirates, which is 4.5% of all attributed UAE claims. Its activity concentrates in Professional Services, accounting for 1 of those claims. The first Medusa claim against a UAE organisation was recorded on , the most recent on .
Data as of , drawn from 192 leak-site claims collected by ransomware.live. This page counts Medusa claims only. How this data is collected and filtered.
Which UAE sectors Medusa targets
| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| Professional Services | 1 | 20% | |
| Financial Services | 1 | 20% | |
| Manufacturing | 1 | 20% | |
| Healthcare | 1 | 20% | |
| Agriculture and Food Production | 1 | 20% | |
| Total | 5 | 100% |
When Medusa claimed UAE organisations
Medusa claimed 5 UAE organisations spread across 5 different sectors, one each, and has recorded nothing since November 2025.
Medusa has claimed 5 UAE organisations
Medusa ranks sixth of 47 groups on this tracker and appears across 5 distinct sectors, one claim in each. The spread is perfectly even. Medusa is also routinely confused with MedusaLocker, which this site counts as a separate operation.
Medusa spread evenly and then stopped
Leak-site monitoring recorded the first Medusa claim against a UAE organisation on 19 May 2023. The most recent was recorded on 21 November 2025. The group claimed 1 organisation in 2023, 1 in 2024 and 3 in 2025.
Medusa has recorded no UAE claim in 2026. Its activity spanned more than two years without ever concentrating on one sector. Professional Services, Financial Services and Manufacturing each carry 1 claim, as do two further sectors.
Medusa and MedusaLocker are counted as separate operations on this site. The names are often confused. Merging them would be an editorial claim about actor identity rather than a fact in the source data.
What this means for UAE organisations
- Read the absence in 2026 as an absence of published claims, not as proof the group has stopped operating.
- Note the even spread across 5 sectors, which offers no sector-specific defence to build against.
- Do not confuse Medusa with MedusaLocker, which appears separately on this tracker with its own record.
- Map your obligations under the UAE Personal Data Protection Law, which applies federally regardless of sector.
- Test external access paths on a schedule, since this group accumulated claims across three separate years.
- Compare this page with Stormous, which also went quiet for a year and then returned.
- Treat a quiet period as no evidence of safety, because organisations that pay before publication never appear in this data.