Filedot.to: Vlad ^hot^

For those looking to manage their own digital assets more effectively, tools like the Microsoft Download Center or Mendeley offer alternative, verified ways to organize and sync personal files. Easy way to share your files - filedot.to

As with any peer-to-peer sharing, there is a risk of malware or hacking associated with downloading unknown .rar or .exe files. It is recommended to use updated antivirus software and avoid entering sensitive data on third-party landing pages.

This post explores what these types of links usually represent and, more importantly, how to navigate file hosting sites like Filedot.to without compromising your device’s security. filedot.to vlad

By: [Your Name], Cyber‑Security Analyst Published: April 2026

| Date | Campaign Name | Primary Vector | Filedot.to Usage | Ransom Note | |------|---------------|----------------|------------------|-------------| | 2023‑02‑23 | Vlad‑Initial | Malspam with macro‑laden Word doc | First observed hosting “VladLock.exe” | VladLock_v1.0.txt | | 2023‑06‑12 | Vlad‑Spring | Business email compromise (BEC) with forged invoices | Uploaded “pspayload.bin” (encrypted PS script) | VladLock_v1.2.txt | | 2024‑01‑05 | Vlad‑Winter | Exploit‑kit dropper via compromised WordPress site | Served “vladpayload.js” via Filedot.to CDN | VladLock_v2.0.txt | | 2024‑09‑14 | Vlad‑Harvest | Phishing via LinkedIn messages | Hosted “harvest.exe” (data‑exfiltration tool) | VladLock_v2.5.txt | | 2025‑03‑31 | Vlad‑AI | AI‑generated spear‑phish with deep‑fake video links | Hosted “ai‑payload.exe” (encrypted with RSA‑4096) | VladLock_v3.0.txt | | 2025‑11‑20 | Vlad‑SupplyChain | Compromise of a popular supply‑chain management SaaS | Used Filedot.to as “fallback C2” for payloads | VladLock_v3.2.txt | For those looking to manage their own digital

While specific links often point to user-uploaded content—ranging from personal backups to media files—navigating these third-party file hosting services requires a specific set of skills to ensure your digital safety.

: Vlad's Blog provides deep dives into SharePoint site identification and Microsoft Graph API. This post explores what these types of links

The alias also appears in and MISP as an actor identifier (ATT&CK Group TXXXXX). Security researchers have grouped several campaigns under the umbrella “Vlad ransomware/extortion” based on common C2 infrastructure, ransomware payload (named “VladLock.exe”), and the persistent use of Filedot.to for payload hosting.

This article presents a overview of both the platform and the threat actor. It is intended for: