Tabufa ransomware: what it is and how to remove it

From our report of May 2019 · not reviewed since

More from our earlier report on Tabufa

• Terminate the threat with the help of powerful security software

From our report of May 2019 · not reviewed since

Tabufa ransomware is crypto malware that encrypts all personal files and drops how_to_back_files.html ransom note on the host device

Tabufa ransomware is a computer infection that targets photos, videos, documents, music, and other files on the device to lock them up with the help of RSA + AES or RSA + RC4 ciphers and then demand ransom for the decryption tool. The amount varies from victim to victim,

The malware stems from the infamous GlobeImposter 2.0 virus family, which was initially spotted back in April 2017, and since then released a variety of variants, reaching over 400 in numbers. This version uses .tabufa extension, which is appended at the end of each file. Since that point, users are unable to access any personal data that is located on the PC, apart from Programs and some other data.

Additionally, Tabufa virus also drops a ransom note how_to_back_files.html, which is simply a message from the ransomware developers. In it, users are explained that they need to email crooks via tabufa@protonmail.com or tabufa@airmail.cc and transfer money in Bitcoin in order to receive the decryptor.

Victims are also offered a free test decryption service for one file. This is a common technique used by hackers to ensure a false sense of security.

However, experts recommend avoiding any contact with bad actors and instead focus on Tabufa ransomware removal. Currently, the virus is not decryptable, but we provide alternative file recovery solutions below. The mentioned ransom message states the following:

There are a variety of techniques that Tabufa file virus authors use in order to infect the maximum number of victims worldwide. For example:

Regardless of how the malware got into your machine, you need to remove Tabufa ransomware as quickly as possible. Nevertheless, be aware that not all AV engines might recognize the threat, so a scan with multiple solutions might be required.

Do not forget that Tabufa ransomware does not only encrypt .jpg, .pdf, .doc, .xtml, .html, .gif, .mp4, and other file types., but also affects Windows OS operation. For example, the virus deletes Shadow Volume copies to complicate the recovery process, modifies the registry, enables new startup items, deletes files, etc.

After that, you can then attempt to recover files encrypted by Tabufa ransomware. Please check the bottom section of this article for alternative methods if you do not have backups prepared.

• Spam email attachments and hyperlinks;
• Exploit kits;
• Pirated software and its cracks;
• Fake updates;
• Unprotected RDP;
• Web injects, etc.

From our report of May 2019 · not reviewed since

Ransomware uses a variety of infection methods - here's how to protect yourself

Ransomware is possibly one of the most destructive malware families around due to the fact that the locked files do not get deciphered after its termination.

In most cases, a scan with reputable anti-virus software would terminate the malware, as multiple AV vendors specialize on ransomware heavily, so its removal is usually not a problem.

However, this would not recover the files back to normal because they are locked and require a unique key that is only accessible to actors. Despite that, security researchers always work on decryptors that would help victims retrieve their files for free.

Therefore, to avoid such an unfortunate situation, you should prevent the infection in the first place. Ensuring that your data is also stored on an external backup device or cloud-based storage would save the day, even if you do manage to get infected. These are the tips from industry experts, so make sure to keep them in mind when using the computer on a daily basis:

• Enable Firewall and install powerful anti-malware software with real-time protection feature;
• Update your Windows operating system regularly;
• Enable automatic updates for all the apps you have installed;
• Avoid email attachments or hyperlinks. If needed, scan the file or the URL with tools like Virus Total;
• Do not download pirated software or its cracks;
• Use ad-blocker on high-risk sites.

From our report of May 2019 · not reviewed since

Do not contact cybercriminals and delete Tabufa ransomware from your system

While there is no official decryptor developed by security researchers yet, you should not pay the ransom and rather remove Tabufa ransomware from your device.

If you oblige, you might get scammed and lose the money altogether. Besides, paying hackers will only prove that the illegal business of ransomware works, and it will prompt them to expand their operations further, developing more advanced threats.

You should perform Tabufa ransomware removal in the Safe Mode with Networking, as in this way malware's operation will be temporarily disabled. Once in Safe Mode, perform a full system scan with anti-malware software - this should be enough to terminate the virus. If you had no backups, check out the bottom section of this article for alternative file recovery solutions.

[GI=method-1]To ensure prompt Tabufa ransomware removal, enter Safe Mode with Networking:

[GI=method-2]You can also use System Restore to terminate the virus:

Windows Previous Versions feature might be useful

This recovery method will only work if you had System Restore enabled before Tabufa infected your PC.

ShadowExplorer might retrieve all your data

This tool should be able to recover all the encrypted data if the virus failed to delete Shadow Volumes.

No decryptor is currently available