# Investigating IPTV Malware in the Wild
## 1 Introduction
An exception is the research that has been conducted for malicious PDF files and fileless threats in the form of malicious JavaScript codes [11]. Features from the embedded PDF files are extracted and utilised for classification. The differentiation of our study with this study is that we have provided an investigation framework, and our classification is based on cyber threat intelligence sources, which depends on the collective work of cyber threat analysts. The novelty of the framework comes within the niche field of IPTV and the recursive collection and query methodology rather than through signature generation over extracted features. Similar malicious URL detection literature can be found in the work of [PERSON] et al. [12]. Moreover, malware threats are constantly changing, necessitating malware analyses to be completed consistently on an ongoing basis to provide timely threat intelligence about the risks of infringing IPTV technologies [13; 14; 15; 16]. Although there are a small number of indicators of compromise (IOCs) relating to illegal IPTV technologies that exist, such as the AlienVault Open Threat Exchange intelligence platforms, our research shows that there is minimal threat intelligence about the main types of malware used, their severity, and the prominent Tactics, Techniques, and Procedures (TTPs) used by threat actors to exploit the devices of infringing IPTV technology users. However, in other areas of research, the prevalent malware families, their severity, and the likelihood of infection from using copyright-infringing technologies have been identified. For example, [PERSON] and [PERSON], while not focusing specifically on infringing IPTV technology, identified the malware families found in technologies providing copyright-infringing digital content and actionable threat intelligence into the main malware threats from digital content piracy technologies, although these may be less relevant for threat intelligence researchers in the future due to the ever-changing nature of malware threats [17; 18]. For example, a security report by Ponemon Institute found that fileless malware [19; 20; 21] attacks have been steadily increasing over time, while the number of zero-day attacks nearly doubled between 2019 and 2020 [22]. Additionally, [PERSON] and [PERSON] found that when searching for popular films in a web browser to identify illicit IPTV websites, 20% of websites had been removed from the search results and replaced with new sites between two rounds of analysis, with 8% of the websites classified as malicious by VirusTotal [17]. These results suggest that both malware threats and the copyright-infringing IPTV ecosystem are changing continuously. This may be partially due to legal \"whack-a-mole\" enforcement that removes illicit websites, coupled with the development of zero-day malware to exploit new vulnerabilities. Therefore, to address this issue, in this paper, we present a framework for analysing malware threats in illegal IPTV technologies, the illegal IPTV Technologies Malware Analysis Framework (IITMAF). The IITMAF has been designed to identify new threats and risks and encourage ongoing evaluation of these. The framework consists of a methodology for securely detecting, collecting, and analysing malware from infringing IPTV technology in addition to identifying and assessing the risks of using these technologies. Moreover, the framework provides a software solution for automating the collection and analysis of malware found in illegal IPTV websites and software, with the focus of the automated software solution being the provision of actionable information. Actionable information should be relevant, timely, accurate, complete, and ingestible [23].