Q:

What is a tabufa file?

I ran across some files on a public share.  The extension is .tabufa.  There is concern this is some sort of hack.  Based on my knowledge of that business unit and some of the file names, I suspect these files have something to do with Tableau.  Most of them are like filename.xlsm.tabufa, but one is filename.lnk.tabufa.
Another likely scenario is someone did a batch rename to tack .tabufa to the end of all file names in that folder, so this may be a wild goose chase.
I have found nothing about this extension by using a search engine.
One other clue:  There is a file named how_to_back_files.html in the same folder.  The user who identified the file extension (Right, it wasn't me.  I don't have access to that folder.) verified that this file contains the ransom note.

A:

These are files that have been encrypted by GlobeImposter 2.0 Ransomware. See this link.

