ToneShell Backdoor Used to Target Attendees of the IISS Defence Summit

**Executive summary:** This report analyzes a ToneShell backdoor campaign attributed to the Mustang Panda APT that used an IISS-themed lure to distribute a malicious PIF which drops SFFWallpaperCore.exe and libemb.dll (ToneShell/PubLoad behaviors), establishes persistence, and communicates with C2 infrastructure hosted on Topway Global Limited IP space; the report includes file hashes, C2 IPs, ASN/certificate details, and behavioral analysis to support detection and mitigation.