RainbowLeaks

RainbowLeaks
Active since 2017-11-20
A website called RainbowLeaks, linked to Rainbow Six: Siege.
Type	[[List_of_Investigations#Official|Official]]
Creator	Ubisoft
Discovered	2017-11-20

Main Page > List of Investigations > RainbowLeaks

RainbowLeaks is an ARG for Ubisoft's competitive online multiplayer shooter Rainbow Six Siege. The ARG was discovered on November 20, 2017, starting with the RainbowLeaks website. At this point, the ultimate purpose of the ARG is unclear, although it has connections to the upcoming PVE content for Rainbow Six Siege, titled "Outbreak".

File 1

The QR code discovered on Oregon

The completed QR code

On November 20, 2017, a QR code was discovered on the Oregon map. In its original form, the QR code is unscannable; in order to be scanned, the empty space in the middle had to be filled with the correct pixels. In the center of the QR code, and to the side of the QR code, the characters C4 are repeated.

Completing the QR Code

The characters C4, found on the QR code itself, form one of the coordinate locations on the QR code grid that need to be filled in. Scattered throughout the map are other small bits of paper with other coordinates listed on them. The locations of each of these notes can be found here. Here is the complete list: (NOTE: many still missing! If you find any, join the Discord server and tell us!)

• 

  (A, 2)

• 

  (A, 4)

• 

  (B, 2)

• 

  (B, 5)

• 

  (B, 7)

• 

  (C, 4)

• 

  (D, 1)

• 

  (D, 2)

• 

  (F, 1)

• 

  (F, 3)

• 

  (F, 4)

• 

  (F, 5)

• 

  (G, 3)

• 

  (G, 6)

These coordinates were used to fill out the empty space in the middle of the QR code. Scanning the QR code leads to the following URL:

http://q-r.to/rnb6TrC

This website displays an image, with the following text in its center:

@rX9p]7'CKr-

Unlocking File 1

Underneath the QR code was a link to rainbowleaks.org. This website contained a locked file named File #1, with the description Dead drop located in Oregon:

Using the password @rX9p]7'CKr- (which was uncovered using the QR code) prompted the user to enter their Ubisoft credentials to log into the RainbowLeaks site. Doing so led to a page with the following text:

My Fellow Facters, we have an opportunity to get ahead of a lie before it becomes another cover-up. Truth or Consequences, New Mexico is experiencing an outbreak and the Feds are a little too quick to send “help,” almost like they’ve been prepared. We’ve managed to smuggle intel out of Truth or Consequences through an ARNG associate of the Manifest Destiny Militia. They share our distrust of FEMA and I can’t do this alone. We need all hands on deck here. So whatever your sources, whatever you can provide, share it here so we can all benefit from it.

Here’s what we know so far: Truth or Consequences is suffering an outbreak of an undetermined nature. The CDC is front and center, and the National Guard is rendering assistance, but all the pieces fell in place way too easily. This has false flag written all over it, but who’s the bad guy here. So give me what you got… let’s add to this database before someone Jimmy Hoffa’s all the evidence.

There were also 5 images underneath:

• 

  First image

• 

  Second image (transcription)

• 

  Third image

• 

  Fourth image

• 

  Fifth image (transcription)

At this time, it is unclear if these images have any further significance, but they appear to relate to the upcoming Outbreak event.

File 2

On December 13, 2017, the RainbowLeaks page was updated with a second locked file. The description of this file was Dead drop located in Presidential Plane. Much like the first file, the second file required a password.

Postcards

On the map Presidential Plane, several different postcards were discovered, each holding different text:

• 

  "Murder not"

• 

  "the Gaggle"

• 

  "nor Quarrel"

• 

  "in the Company"

• 

  "of a Colony"

• 

  "or Conspiracy"

Each postcard has one capitalized word, which happens to be a collective noun for a group of birds:

• A murder of crows
• A gaggle of geese
• A quarrel of sparrows
• A company of parrots
• A colony of penguins
• A conspiracy of ravens

It was some time before the significance of the bird names were determined.

Twitter Hint

On December 16, 2017, the Rainbow 6 Siege Twitter account responded to a tweet by a Dr. Sztajnkrycer, whose name could be seen in the first file's documents. The message read as follows:

// Scrambled communication incoming //
bggylookocpkvsdzqhkkjhihhuipoforppmigpbgrligldywjbeytteljoopshqcblettersokizzbnrpxsvdtxwaboaflvltwucphrhmipa
jbixqmalnnxlsnbhxlpofpwrkkjfnmbstzdpqdfoeukcyafjggfiklpqsotpgwpgmhzuosvbyasnsujorkvpaxhvexgrbebirdsacnoxscsm
// End transmission //

The words look, for, letters, of, and birds could be clearly seen in the scrambled text above - as such, it was interpreted as another nudge towards the "birds" theory for the postcards. The reply from the official Rainbow 6 Siege twitter was simply:

Cease all communication immediately.
Remain where you are.

Unlocking File 2

On December 18, 2017, the second file on the RainbowLeaks site was finally unlocked. Taken together, the words on the postcards read as follows:

Murder not the Gaggle nor Quarrel in the Company of a Colony or Conspiracy

By replacing the collective nouns with their respective birds, this turned into the following phrase:

Crow not the Goose nor Sparrow in the Parrot of a Penguin or Raven

Taking the first letter of each word in that phrase led to CntGnSitPoaPoR, which was the password for the second file. When unlocked, the file contained the following text:

The President’s plane got attacked! It’s been grounded! Tell me this isn’t coincidence? Was the President trying to shut it down? Was he too close to the lies? Is this Phase II of the Truth or Consequences operation? I’ll tell you something the timing is terrible. It may have cost us a Facter within the inner circle who was helping us. He fired off some intel before the plane went dark, but what did he leave behind? We’ll never know but we’ll have to move carefully. They’re playing for keeps so that means the stakes are high. Keep that data coming, don’t let them derail the train! I’ll have more for you after we talk to some of our friends in the Russian hacking community.

There were also 5 images underneath:

• 

  First image

• 

  Second image

• 

  Third image

• 

  Fourth image

• 

  Fifth image

The fourth image reads as follows:

(Something is not clear about this!!)
You’ve always admired me for being a straight shooter, so let line this up for you and you polish it however you need to avoid brushing the honorable Senator’s ego. With all due respect to your boss, this isn’t the time for ad hoc stump speeches to the press. The National Guard is a vital component of our military, absolutely, but they are not equipped to handle this situation. This has nothing to to do with breaking the Posse Comitatus or the White House overextending its reach here, and it’s that kind of grandstanding that’s sending panic meters into the red. 

Truth or Consequences is quarantined, and the President is fully in his right to assign the Army to render assistance in the case of epidemics as he’s done, but don’t fool yourself… this goes beyond quarantine measures. Bellyaching about the Army mobilizing to step in blew the lid on the seriousness of the event before the President could get ahead of this thing. We’re still working on classifying and containing the situation and your boss let reporters walk right on through the front door of our house. Let me set the record straight: we are NOT suspending Habeas Corpus and the President isn’t trying to curry favor or swing opinion polls by acting tough. Every alphabet agency from A.F.I to N.S.A is tasked on finding out the “whys” of the outbreak, but we need the army to contain the situation and SOCOM to render assistance in the evacuation of vital medical personnel and assets from the field. The reports that the citizens of Truth or Consequence are “rioting” remains unsubstantiated. I also don’t know the Honorable Senator thinks he heard about “foreign operatives” rendering assistance in this time of crisis, but for his sake, I highly recommend he unhear it fast. If your boss still listens to you, a highly encourage you to sway him from his current rhetoric. 
(Covering something Big!!)

with "Something is not clear about this" circled around the areas National Guard not being able to handle this situation, and "Covering something big" circled around the area advising the senator to unhear whatever he heard about foreign operatives.

The fifth image reads as follows:

Phone call Transcript #0245 - 	█████████████████████████ at 1451 hours

[Kevin V.]: I don’t know what’s happening, but they’ve pulled us back outside of town
[Alicia M.]: Are they saying anything?
[Kevin V.]: No comment.
[Alicia M.]: C’mon Kevin. You wouldn’t call me with a ‘no comment.’
[Pause]
[Alicia M.]: Kevin?
[Kevin V.]: Sorry, Guardsmen walked by. They aren’t happy about “Mother Army” stepping in-looking for a spot to talk.
[Alicia M.]: That’s not surprising. So…?
[Kevin V.]: Okay. We’ve been hearing gunfire and explosions coming from the town. I tried to sneak some shots and got my other cell confiscated. They almost kicked me out. 

[Alicia M.]: They’re shooting people?
[Kevin V.]: I think-I think they’re defending themselves.
[Alicia M.]: Well, it’s New Mexico. They do have a lot of firear--
[Kevin V.]: No no, it’s not that. Al, I’ve been in Mosul and Aleppo.
I know battlefield trauma and this is… different. There’s a lot of blunt force trauma or-or gaping wounds… I mean really horrible shit like I’m looking at earthquake victims, not war wounds… no GSWs or explosives-related injuries. I got in closer for a peek, but the med tent is INSIDE the quarantine zone away from their forward operating base, and the injured are mostly soldiers.

[Alicia M.]: What the hell is going on there?
[Kevin V.]: I don’t know and the Guardsmen I spoke to said they’d probably evacuate us too for our own safety.
[Alicia M.]: They can’t do that.
[Kevin V.]: It’s not going to stop them, but I’m not going to be around either.
[Alicia M.]: Okay… look, you be safe, and keep your fucking head down. If they catch you--
[Kevin V.]: They won’t. You’ll be hearing from me soon.

File 3

On January 23, 2018, the RainbowLeaks site was updated to include File 3, whose description read Dead drop located in Kafe Dostoyevsky.

Cafe Notes

The same day, the game was updated. Players discovered notes hidden on the Kafe Dostoyevsky map:

• 

  1-2-7

• 

  1-3-16

• 

  1-4-18

• 

  g
  1-5-4

• 

  2-29-1

• 

  gu
  2-31-11

• 

  d
  2-32-33

• 

  3-41-8

• 

  3-42-70

• 

  3-43-5

• 

  3-44-4

• 

  4-56-1

• 

  4-57-1

• 

  4-58-1

• 

  4-59-4

• 

  m
  20-30-10

So far, 15 notes have been found. At this time, the meaning of the notes is unclear, though some speculate they are part of a book cipher.

This wiki page is under construction! It will be updated with new developments.