Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 21:03:13 UTC Home > List all groups > List all tools > List all groups using tool TABBYCAT Tool: TABBYCAT Names TABBYCAT Category Malware Type Dropper Description (Mandiant) TABBYCAT is a Microsoft Word VBA macro that functions as a dropper. It relies on social engineering in order to be executed as a macro within a decoy Microsoft Word document. It decodes a payload embedded in a UserForm and launches it. TABBYCAT has been observed dropping the VBREVSHELL backdoor. Information Last change to this tool card: 13 September 2022 Download this tool card in JSON format All groups using tool TABBYCAT Changed Name Country Observed APT groups   APT 42 2015-Feb 2024   1 group listed (1 APT, 0 other, 0 unknown) Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f2492a15-807d-4884-a9c5-26a237bad2bf https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f2492a15-807d-4884-a9c5-26a237bad2bf Page 1 of 1