Difference between revisions of "Teragon"
From Game Detectives Wiki
| [checked revision] | [checked revision] |
(IS THIS JUST FANTASY) |
|||
| (12 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
| + | {{argbox | ||
| + | |type = Unofficial | ||
| + | |creator=[https://wiki.gamedetectives.net/index.php?title=Gayfarang gayfarang] | ||
| + | |discovered = 2016-01-31 | ||
| + | |status = Completed | ||
| + | }} | ||
| + | |||
| + | {{ArgHeader}} | ||
| + | |||
The Teragon ARG was made by [[gayfarang]]. It followed the story of an agency named Teragon, whose goal was to protect the world against a nefarious group of terrorists. Teragon was followed by the [[EFS]] ARG. | The Teragon ARG was made by [[gayfarang]]. It followed the story of an agency named Teragon, whose goal was to protect the world against a nefarious group of terrorists. Teragon was followed by the [[EFS]] ARG. | ||
| Line 9: | Line 18: | ||
what the hell? There's something very weird going on here: https://www.youtube.com/channel/UChbNByMTjZnnqJAMPkvD_vg/videos? sort=dd&view=0&shelf_id=0 | what the hell? There's something very weird going on here: https://www.youtube.com/channel/UChbNByMTjZnnqJAMPkvD_vg/videos? sort=dd&view=0&shelf_id=0 | ||
| − | The YouTube channel contained 40+ short, cut-and-looped videos of professional Dota 2 player [ | + | The YouTube channel contained 40+ short, cut-and-looped videos of professional Dota 2 player [https://wiki.teamliquid.net/dota2/EternaLEnVy EternaLEnVy (aka EE)] being interviewed, each featuring a one-word title as well as a title screen before the looped clip. |
After seeing the YouTube link while browsing /d2g/, A Reddit user made a [https://www.reddit.com/r/DotA2/comments/43lyu3/the_average_eternalenvy_fan/ post] on /r/dota2 about it. | After seeing the YouTube link while browsing /d2g/, A Reddit user made a [https://www.reddit.com/r/DotA2/comments/43lyu3/the_average_eternalenvy_fan/ post] on /r/dota2 about it. | ||
| Line 71: | Line 80: | ||
Another Reddit user discovered that the encrypted text in <code>wewillreshapetheworld.txt</code> was a Vigenere cipher with the passphrase "This was Teragon born". Once decrypted, the text read <code>betrayalwasnecessary</code>. Since a player had already found that URL, focus switched to the image on the page. | Another Reddit user discovered that the encrypted text in <code>wewillreshapetheworld.txt</code> was a Vigenere cipher with the passphrase "This was Teragon born". Once decrypted, the text read <code>betrayalwasnecessary</code>. Since a player had already found that URL, focus switched to the image on the page. | ||
| − | One player pointed out that the depiction of Baphomet found on the <code>betrayalwasnecessary</code> page was known as the "Dogme et Rituel de la Haute Magie" (English: Dogma and Ritual of High Magic), and it derived from two books by French occult author & ceremonial magician [https://en.wikipedia.org/wiki/Eliphas_Levi Eliphas Levi], namely "Dogme" and "Rituel". Another player ran the image through a [ | + | One player pointed out that the depiction of Baphomet found on the <code>betrayalwasnecessary</code> page was known as the "Dogme et Rituel de la Haute Magie" (English: Dogma and Ritual of High Magic), and it derived from two books by French occult author & ceremonial magician [https://en.wikipedia.org/wiki/Eliphas_Levi Eliphas Levi], namely "Dogme" and "Rituel". Another player ran the image through a [https://imagesteganography.codeplex.com/ steganography tool] and revealed the following text hidden within: |
<pre> | <pre> | ||
| Line 120: | Line 129: | ||
=== More Emails === | === More Emails === | ||
| − | Simultaneous to the livestream, the Teragon Group began responding to more application emails. Many people received a [ | + | Simultaneous to the livestream, the Teragon Group began responding to more application emails. Many people received a [https://pastebin.com/SpubQeyw response] which read: |
<pre> | <pre> | ||
| Line 169: | Line 178: | ||
</pre> | </pre> | ||
| − | One Discord user discovered that these numbers could be applied as a book cipher to the prologue of "Le Roi de fer." Taking each number to be a pair of values - the first being a line number, and the second the n^th letter in a line (ie 69 = line 6, letter 9, etc.) - [ | + | One Discord user discovered that these numbers could be applied as a book cipher to the prologue of "Le Roi de fer." Taking each number to be a pair of values - the first being a line number, and the second the n^th letter in a line (ie 69 = line 6, letter 9, etc.) - [https://i.imgur.com/SIZeTXn.jpg this image] of the prologue can be used in combination with the cipher to reveal to word <code>continue</code>. |
===Press Any Key to Continue=== | ===Press Any Key to Continue=== | ||
| Line 255: | Line 264: | ||
===The Leaked Bounty=== | ===The Leaked Bounty=== | ||
| − | Among the URLs on the leaked index, a new file, <code>anewbeginning.png</code> was discovered, displaying a message in [https://en.wikipedia.org/wiki/Flag_semaphore Flag Semaphore code], which was translated to <code>donotdespair<code>. This led players to <code>donotdespair.txt</code>, which read: | + | Among the URLs on the leaked index, a new file, <code>anewbeginning.png</code> was discovered, displaying a message in [https://en.wikipedia.org/wiki/Flag_semaphore Flag Semaphore code], which was translated to <code>donotdespair</code>. This led players to <code>donotdespair.txt</code>, which read: |
<pre> | <pre> | ||
| Line 265: | Line 274: | ||
===Mister... Wan...=== | ===Mister... Wan...=== | ||
| − | + | At some point during the chaos caused by the leak, a theory was formulated, based on "messages from Laetitia told us to speak with him, because he was an Teragon operative", that Reddit user /u/TonyWan, the user who solved the Phantom Assassin clue, was, in fact, involved with the Teragon Group. | |
| + | |||
| + | A Reddit user sent /u/TonyWan a private message, which read: | ||
| − | + | <pre> | |
Hello, Mr. Tony. | Hello, Mr. Tony. | ||
You may know me as JM. Be wary that you are being investigated by ISSP as a possible part of the leak on our website. You better share with us what you know. | You may know me as JM. Be wary that you are being investigated by ISSP as a possible part of the leak on our website. You better share with us what you know. | ||
| + | </pre> | ||
| − | + | /u/TonyWan later replied: | |
| − | |||
| − | |||
| + | <pre> | ||
This is highly suspicious. Why would JM contact me here and not on our Intranet? | This is highly suspicious. Why would JM contact me here and not on our Intranet? | ||
Okay, if you really are who you say you are, let's try something. | Okay, if you really are who you say you are, let's try something. | ||
Every year in March, we celebrate the anniversary of the brightest day of our organization in front of a plaque. Over the plaque is a bridge. Cross the bridge, what is the name of the building to your left? | Every year in March, we celebrate the anniversary of the brightest day of our organization in front of a plaque. Over the plaque is a bridge. Cross the bridge, what is the name of the building to your left? | ||
Visit the file named after that building. | Visit the file named after that building. | ||
| + | </pre> | ||
===Samaritaine=== | ===Samaritaine=== | ||
| − | + | It was deduced that the bridge referred to by /u/TonyWan was the [https://paris.worldtravelcompanion.net/wp-content/uploads/2013/06/Pont-Neuf-Bridge-2.jpg Pont Neuf], as the bridge is across from a plaque memorializing De Molay's death located by the Seine River. Across the Pont Neuf bridge and to the left is a department store named "Samaritaine." This clue led players to a new file, <code>samaritaine.png</code>. Through the use of an [https://enigmaco.de/enigma/enigma.html Enigma machine simulator] with rotors set according to <code>samarataing.png</code> and an input of <code>RCTHHONEMPKMG<code>, a new file, titled <code>hiddenhistory.mp3</code> was discovered. | |
| − | + | Players quickly discovered that the audio file contained a message in Morse. Converting the Morse Code to base64, then the base64 to hex, then the hex to md5, allows one to decipher to word <code>Administrator</code>. | |
| − | + | This led players to the file <code>administrator.txt</code>, which contained the following series of numbers: | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| + | <pre> | ||
01917 22334 65111 33610 14011 10500 55316 11391 31515 12011 54111 42011 34799 60005 53313 16005 03036 31681 40381 30220 33189 51269 41014 00074 35210 13380 55627 | 01917 22334 65111 33610 14011 10500 55316 11391 31515 12011 54111 42011 34799 60005 53313 16005 03036 31681 40381 30220 33189 51269 41014 00074 35210 13380 55627 | ||
| + | </pre> | ||
| − | + | Players used a cipher with the passphrase "Giving You a Better World" (phrase found on Teragon Group's webpage) on administrator.txt and revealed the following message: | |
| + | <pre> | ||
OUR GOAL IS NEAR IT IS WITHIN OUR GRASP | OUR GOAL IS NEAR IT IS WITHIN OUR GRASP | ||
SOON WE WILL ACCOMPLISH OUR LOFTY GOALSTAYSTRONGD | SOON WE WILL ACCOMPLISH OUR LOFTY GOALSTAYSTRONGD | ||
| + | </pre> | ||
| − | + | Initially, this clue lead players to the file <code>staystrong.png</code> on the Teragon website, but quickly became inaccessible. This led players to the file <code>staystrong.txt</code>, which contained a link to an unlisted [https://youtu.be/qOOW9iRUI4I YouTube video] on the Baphomet Studio channel of footage of a harbor. | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
===Vive La Rochelle!=== | ===Vive La Rochelle!=== | ||
| − | + | Discord users quickly realized that all the locations filmed in the video linked in <code>staystrong.txt</code> were in the city of La Rochelle, France. This led players to a new file, <code>larochelle.txt</code>, which read: | |
| + | <pre> | ||
122 105 153 154 115 152 102 103 122 123 61 125 123 60 106 111 112 124 111 167 125 60 126 112 125 171 125 171 115 105 112 106 114 126 122 114 121 125 147 154 115 152 102 104 123 105 105 164 122 60 126 106 112 124 111 167 121 153 125 164 126 105 164 102 123 103 125 171 115 105 65 102 125 60 147 164 122 105 71 112 122 123 61 125 125 60 70 154 115 152 102 125 125 60 125 164 124 153 154 115 124 103 125 171 115 105 122 112 121 153 126 111 112 124 111 167 121 123 61 130 124 60 147 154 115 152 102 103 122 123 61 125 123 60 106 111 112 124 111 167 122 105 154 103 122 125 147 154 115 152 102 125 123 105 106 117 114 126 160 112 122 123 125 171 115 105 122 141 122 125 147 154 115 152 102 104 124 105 105 164 122 60 153 164 121 125 154 111 112 124 111 167 121 153 125 164 126 105 164 102 123 103 125 171 115 105 112 112 123 103 61 125 125 60 125 164 122 105 154 111 112 124 111 167 121 153 125 164 126 105 164 102 123 103 125 171 115 105 116 111 121 123 61 110 122 125 125 154 115 152 102 103 122 123 61 125 123 60 106 111 112 124 111 167 126 106 116 102 114 125 125 164 122 105 71 117 123 125 64 164 122 125 125 154 115 152 102 102 114 125 116 111 123 123 125 171 115 105 122 102 123 103 61 117 122 126 115 164 126 106 116 102 112 124 111 167 123 60 170 106 125 60 147 154 115 152 102 105 114 125 106 111 112 124 111 167 121 153 125 164 126 105 164 102 123 103 125 171 115 105 65 102 125 60 147 164 122 105 71 112 122 123 61 125 125 60 70 154 115 152 102 102 123 103 61 113 121 125 147 154 115 152 102 114 124 105 126 124 123 103 125 171 115 105 164 115 122 126 116 111 112 124 111 167 124 153 125 164 121 125 150 124 114 125 160 102 123 103 125 171 115 106 122 124 121 125 147 154 115 152 101 154 115 152 102 103 122 123 61 125 123 60 106 111 112 124 111 167 126 106 116 106 114 125 65 112 124 105 167 154 115 152 102 105 121 125 147 164 124 153 126 124 114 126 122 124 121 123 125 171 115 105 106 111 114 125 65 102 123 103 125 171 115 106 122 124 121 125 147 164 121 126 115 164 127 153 154 111 112 124 111 167 124 153 125 164 121 125 150 124 114 125 160 102 123 103 125 171 115 106 116 111 123 123 61 105 121 123 125 171 115 105 106 111 114 125 170 120 125 61 157 154 115 152 102 102 123 103 61 117 121 125 147 154 115 152 102 103 122 123 61 115 121 123 61 124 121 125 65 102 112 124 111 167 121 60 150 112 124 153 122 112 112 124 111 167 126 106 116 102 123 103 61 102 125 171 61 141 123 125 147 75 | 122 105 153 154 115 152 102 103 122 123 61 125 123 60 106 111 112 124 111 167 125 60 126 112 125 171 125 171 115 105 112 106 114 126 122 114 121 125 147 154 115 152 102 104 123 105 105 164 122 60 126 106 112 124 111 167 121 153 125 164 126 105 164 102 123 103 125 171 115 105 65 102 125 60 147 164 122 105 71 112 122 123 61 125 125 60 70 154 115 152 102 125 125 60 125 164 124 153 154 115 124 103 125 171 115 105 122 112 121 153 126 111 112 124 111 167 121 123 61 130 124 60 147 154 115 152 102 103 122 123 61 125 123 60 106 111 112 124 111 167 122 105 154 103 122 125 147 154 115 152 102 125 123 105 106 117 114 126 160 112 122 123 125 171 115 105 122 141 122 125 147 154 115 152 102 104 124 105 105 164 122 60 153 164 121 125 154 111 112 124 111 167 121 153 125 164 126 105 164 102 123 103 125 171 115 105 112 112 123 103 61 125 125 60 125 164 122 105 154 111 112 124 111 167 121 153 125 164 126 105 164 102 123 103 125 171 115 105 116 111 121 123 61 110 122 125 125 154 115 152 102 103 122 123 61 125 123 60 106 111 112 124 111 167 126 106 116 102 114 125 125 164 122 105 71 117 123 125 64 164 122 125 125 154 115 152 102 102 114 125 116 111 123 123 125 171 115 105 122 102 123 103 61 117 122 126 115 164 126 106 116 102 112 124 111 167 123 60 170 106 125 60 147 154 115 152 102 105 114 125 106 111 112 124 111 167 121 153 125 164 126 105 164 102 123 103 125 171 115 105 65 102 125 60 147 164 122 105 71 112 122 123 61 125 125 60 70 154 115 152 102 102 123 103 61 113 121 125 147 154 115 152 102 114 124 105 126 124 123 103 125 171 115 105 164 115 122 126 116 111 112 124 111 167 124 153 125 164 121 125 150 124 114 125 160 102 123 103 125 171 115 106 122 124 121 125 147 154 115 152 101 154 115 152 102 103 122 123 61 125 123 60 106 111 112 124 111 167 126 106 116 106 114 125 65 112 124 105 167 154 115 152 102 105 121 125 147 164 124 153 126 124 114 126 122 124 121 123 125 171 115 105 106 111 114 125 65 102 123 103 125 171 115 106 122 124 121 125 147 164 121 126 115 164 127 153 154 111 112 124 111 167 124 153 125 164 121 125 150 124 114 125 160 102 123 103 125 171 115 106 116 111 123 123 61 105 121 123 125 171 115 105 106 111 114 125 170 120 125 61 157 154 115 152 102 102 123 103 61 117 121 125 147 154 115 152 102 103 122 123 61 115 121 123 61 124 121 125 65 102 112 124 111 167 121 60 150 112 124 153 122 112 112 124 111 167 126 106 116 102 123 103 61 102 125 171 61 141 123 125 147 75 | ||
| + | </pre> | ||
| − | |||
| − | + | Players quickly realized that the text contained in <code>larochelle.txt</code> was octal, and decoded to: | |
| − | + | <pre> | |
| + | REklMjBCRS1US0FIJTIwU0VJUyUyMEJFLVRLQUglMjBDSEEtR0VFJTIwQkUtVEtBSCUyME5BU0gtRE9JRS1UU08lMjBUU0UtTklMTCUyMERJQkVIJTIwQS1XT0glMjBCRS1US0FIJTIwRElC RUglMjBUSEFOLVpJRSUyMERaRUglMjBDTEEtR0ktQUlIJTIwQkUtVEtBSCUyMEJJSC1UU0UtRElIJTIwQkUtVEtBSCUyMENIQS1HRUUlMjBCRS1US0FIJTIwVFNBLUUtRE9OSU4tRUUlMjBBL UNISSUyMERBSC1ORVMtVFNBJTIwS0xFU0glMjBELUFIJTIwQkUtVEtBSCUyME5BU0gtRE9JRS1UU08lMjBBSC1KQUglMjBLTEVTSCUyMEtMRVNIJTIwTkUtQUhTLUpBSCUyMFRTQUglMjAlMj BCRS1US0FIJTIwVFNFLU5JTEwlMjBEQUgtTkVTLVRTQSUyMEFILU5BSCUyMFRTQUgtQVMtWklIJTIwTkUtQUhTLUpBSCUyMFNISS1EQSUyMEFILUxPU1olMjBBSC1OQUglMjBCRS1MQS1TQU5 BJTIwQ0hJTkRJJTIwVFNBSC1BUy1aSUg= | ||
| + | </pre> | ||
| − | + | Players recognized this as base-64, which decoded to: | |
| + | <pre> | ||
DI BE-TKAH SEIS BE-TKAH CHA-GEE BE-TKAH NASH-DOIE-TSO TSE-NILL DIBEH A-WOH BE-TKAH DIBEH THAN-ZIE DZEH CLA-GI-AIH BE-TKAH BIH-TSE-DIH BE-TKAH CHA-GEE BE-TKAH TSA-E-DONIN-EE A-CHI DAH-NES-TSA KLESH D-AH BE-TKAH NASH-DOIE-TSO AH-JAH KLESH KLESH NE-AHS-JAH TSAH BE-TKAH TSE-NILL DAH-NES- TSA AH-NAH TSAH-AS-ZIH NE-AHS-JAH SHI-DA AH-LOSZ AH-NAH BE-LA-SANA CHINDI TSAH-AS-ZIH | DI BE-TKAH SEIS BE-TKAH CHA-GEE BE-TKAH NASH-DOIE-TSO TSE-NILL DIBEH A-WOH BE-TKAH DIBEH THAN-ZIE DZEH CLA-GI-AIH BE-TKAH BIH-TSE-DIH BE-TKAH CHA-GEE BE-TKAH TSA-E-DONIN-EE A-CHI DAH-NES-TSA KLESH D-AH BE-TKAH NASH-DOIE-TSO AH-JAH KLESH KLESH NE-AHS-JAH TSAH BE-TKAH TSE-NILL DAH-NES- TSA AH-NAH TSAH-AS-ZIH NE-AHS-JAH SHI-DA AH-LOSZ AH-NAH BE-LA-SANA CHINDI TSAH-AS-ZIH | ||
| + | </pre> | ||
| − | + | Players recognized this message to be Navajo code, and translated to: | |
| + | <pre> | ||
THIS IS THEY LAST STEP PREVIOUS THEY FIRST LESSON AREYOUREADY | THIS IS THEY LAST STEP PREVIOUS THEY FIRST LESSON AREYOUREADY | ||
| + | </pre> | ||
| − | + | This led players to the file <code>areyouready.txt</code>, which contained the following: | |
| + | <pre> | ||
Have you remembered your lesson? | Have you remembered your lesson? | ||
A city and a pillar. | A city and a pillar. | ||
21946101621435413693530515 | 21946101621435413693530515 | ||
| + | </pre> | ||
| − | + | Shortly afterwards, the previously discovered <code>donotdespair.txt</code> updated to read: | |
| + | <pre> | ||
We're monitoring your progress. | We're monitoring your progress. | ||
You're doing great! Even faster than we expected! | You're doing great! Even faster than we expected! | ||
Go on, you're not very far now. | Go on, you're not very far now. | ||
| + | </pre> | ||
| − | + | It was at this point that a player was able to decode the PDF from earlier using leftover numbers from <code>parchment.png</code> and a tridigital cipher. This discovery was made because the initial creator of the tridigital cipher had the username of "owleyes," which was an earlier clue. A Pastebin of the decoded document can be found [https://pastebin.com/XQbJAxYU here]. | |
| − | |||
| − | |||
| − | |||
| − | |||
==February 4th, 2016 - The Fuse Is Lit== | ==February 4th, 2016 - The Fuse Is Lit== | ||
| Line 351: | Line 362: | ||
===Hard Work=== | ===Hard Work=== | ||
| − | + | Sometime overnight, the <code>staystrong</code> image was updated to show the roof of the [https://en.wikipedia.org/wiki/Rosslyn_Chapel Rosslyn Chapel], the same chapel that the pillar before was from. | |
| − | |||
| − | |||
| + | In addition, <code>donotdespair.txt</code> was updated to read: | ||
| + | <pre> | ||
Give up now. | Give up now. | ||
| − | + | </pre> | |
| − | + | areyouready.txt was also updated to read: | |
| − | + | <pre> | |
Have you remembered your lesson? | Have you remembered your lesson? | ||
A city and a chapel. | A city and a chapel. | ||
21946101621435413693530515 | 21946101621435413693530515 | ||
| + | </pre> | ||
| − | + | It became clear that the key to the code wasn't the pillar, but actually the chapel that the pillar was in. | |
| − | + | Known Teragon Operative /u/Tonywan made a [https://www.reddit.com/r/ARG/comments/43rwd4/yesterday_an_arg_was_discovered_on_rdota2/cznf7ll Reddit post] which suggested that a previously-used cipher was reused. | |
| + | <pre> | ||
How humiliating it must be to twice be stumped by the same code. | How humiliating it must be to twice be stumped by the same code. | ||
| + | </pre> | ||
| − | + | /u/Tonywan made another post on Reddit, which linked to a [https://goo.gl/D5a5L3 board game on Amazon]. | |
| + | <pre> | ||
Still stumped? Aww. | Still stumped? Aww. | ||
| − | OK, I'm a pretty nice guy overall, so, if you want to, click here to get a clue: | + | OK, I'm a pretty nice guy overall, so, if you want to, click here to get a clue: https://goo.gl/D5a5L3 |
| + | </pre> | ||
| − | + | The [https://www.youtube.com/channel/UChbNByMTjZnnqJAMPkvD_vg Baphomet Studios] YouTube channel updated with a new [https://www.youtube.com/watch?v=O4eHQOsWd-k video], featuring many depictions of the previously significant <code>OWLEYES</code>. This, combined with /u/Tonywan's post, and the hint "Have you remembered your lesson?" strongly suggested that another tridigital cipher was used for this code. | |
| − | |||
| − | |||
| + | Using this information, a Discord user was able to decode <code>areyouready.txt</code> with the numerical key <code>larochelle</code> and the alphabetical key <code>rosslyn</code> to yield the plaintext message: | ||
| + | <pre> | ||
youdeserveanexplanation | youdeserveanexplanation | ||
| + | </pre> | ||
| − | + | Another Discord user then used this information to find the hidden directory <code>youdeserveanexplanation/</code> on the Teragon website, leading to a wealth of new clues. | |
===The Lord of Pits=== | ===The Lord of Pits=== | ||
| − | + | The directory <code>youdeserveanexplanation/</code> contained the following files: | |
| + | <pre> | ||
>[BRIEFING-Leaks.pdf | >[BRIEFING-Leaks.pdf | ||
| Line 398: | Line 416: | ||
notice.txt | notice.txt | ||
welcome.txt | welcome.txt | ||
| + | </pre> | ||
| − | + | Encrypted.rar, in particular, was of interest. At the same time, Laeticia updated donotdespair.txt to contain the code <ode>bdnsluosreladayr</code> | |
| − | + | Discord users and Dota 2 fans realized identified this code as an anagram, and managed to unscramble it to obtain the password to Encrypted.rar: | |
| − | |||
| − | |||
| + | <pre> | ||
abyssalunderlord | abyssalunderlord | ||
| + | </pre> | ||
===MapQuest is back!=== | ===MapQuest is back!=== | ||
| − | + | The RAR archive was extracted to obtain the file <code>xxx.txt</code>: | |
| + | <pre> | ||
The journey will bring you to the truth | The journey will bring you to the truth | ||
PLHUSKCZHR | PLHUSKCZHR | ||
| Line 417: | Line 437: | ||
SASYAEIQJO | SASYAEIQJO | ||
TDLYSDEG | TDLYSDEG | ||
| + | </pre> | ||
| − | + | A Discord user identified the code as a string of ISO country abbreviations. The code translated to: | |
| + | <pre> | ||
poland, hungary, slovakia, czech republic, croatia | poland, hungary, slovakia, czech republic, croatia | ||
libya, chad, sudan, egypt | libya, chad, sudan, egypt | ||
| Line 425: | Line 447: | ||
saudi arabia, syria, united arab emirates, iraq, jordan | saudi arabia, syria, united arab emirates, iraq, jordan | ||
chad, libya, sudan, egypt | chad, libya, sudan, egypt | ||
| + | </pre> | ||
| − | + | These countries were then plotted out in order on [https://i.imgur.com/hUiJVIe.jpg a map] to obtain the word <code>HUMAN</code>. | |
| − | |||
| − | > HUMAN | ||
===More Mapping!=== | ===More Mapping!=== | ||
| − | + | Using the solved map code, <code>human.txt</code> was discovered on the website. | |
| − | + | At first, the text file read: | |
| + | <pre> | ||
By adding thEse two numbers together, you will read the truth. | By adding thEse two numbers together, you will read the truth. | ||
355 292 | 355 292 | ||
| + | </pre> | ||
| − | + | Later on, human.txt was updated to read | |
| + | <pre> | ||
48°50'01.0"N 2°22'32.8"E | 48°50'01.0"N 2°22'32.8"E | ||
355 + 292 | 355 + 292 | ||
| + | </pre> | ||
| + | |||
| + | A Discord user found that the coordinates to [https://puu.sh/mVPzC/e9130001dc.jpg point to a Parisian library]. Soon after this discovery, <code>human.txt</code> was updated to read: | ||
| + | |||
| + | <pre> | ||
| + | 40¡Æ45'13.2"N 73¡Æ58'58.8"W | ||
| + | 355 + 292 | ||
| + | </pre> | ||
| − | + | This new set of coordinates pointed players to a library in New York. Again, <code>human.txt</code> was updated to read: | |
| − | + | <pre> | |
| + | 35°39'08.5"N 139°43'34.6"E | ||
| − | |||
355 + 292 | 355 + 292 | ||
| + | </pre> | ||
| + | |||
| + | This set of coordinates pointed to a [https://i.imgur.com/TRe3pIT.png Tokyo library]. Yet again, <code>human.txt</code> was updated to read: | ||
| + | |||
| + | <pre> | ||
| + | 12°02'54.2"S 77°01'43.1"W | ||
| + | 355 + 292 | ||
| + | </pre> | ||
| + | |||
| + | This set of coordinates pointed to a location near a [https://www.google.com/maps/place/12%C2%B002'54.2%22S+77%C2%B001'43.1%22W/@-12.048606,-77.0288917,18.47z/data=!4m2!3m1!1s0x0:0x0 Lima library]. Human.txt was updated another time to read: | ||
| + | |||
| + | <pre> | ||
| + | 26°12'16.0"S 28°02'21.4"E | ||
| + | 355 + 292 | ||
| + | </pre> | ||
| + | |||
| + | This set of coordinates pointed to a [https://www.google.com/maps/place/26%C2%B012'16.0%22S+28%C2%B002'21.4%22E/@-26.2045419,28.039175,72m/data=!3m1!1e3!4m2!3m1!1s0x0:0x0 Johannesburg library]. Finally, <code>human.txt</code> was updated with this ominous message: | ||
| + | |||
| + | <pre> | ||
| + | Dear recruits, | ||
| + | We know what you are trying to do. (Did you think we were that blind?) | ||
| + | I would like to talk to you, but unfortunately I'm a busy man and I'm afraid I can't wait forever. | ||
| + | You have one hour to find the solution to this little problem. It shouldn't be too hard since some of you came quite close to the solution. Think not of a literal addition, but of a more... hmmm.. intellectual one? | ||
| + | Don't worry, I will still talk to you even if you fail to solve this problem. But, there will be consequences down the line. | ||
| + | 355 + 292 | ||
| + | </pre> | ||
| − | + | The libraries linked suggested that the numbers actually referred to the Dewey Decimal System. Thus, the message was decoded as: | |
| − | + | ||
| − | + | <pre> | |
| − | + | Classical religion + military science | |
| − | + | </pre> | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | A Discord user realized that the code was referring to Mars, the Roman god of war. This led to a discovery of a whole new directory at <code>/mars/</code>. | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
===A Critical Decision=== | ===A Critical Decision=== | ||
| Line 526: | Line 553: | ||
Hey, you don't have the code by any chance? | Hey, you don't have the code by any chance? | ||
Brett | Brett | ||
| − | + | https://strawpoll.me/6727907 | |
PS: You have one hour. Your choice is final. | PS: You have one hour. Your choice is final. | ||
| Line 548: | Line 575: | ||
X | X | ||
| − | + | https://strawpoll.me/6727907 | |
PS: You have one hour. Your choice is final. | PS: You have one hour. Your choice is final. | ||
| Line 594: | Line 621: | ||
1.51,1.63,1.64,2.40 | 1.51,1.63,1.64,2.40 | ||
| − | * Discord chat user DR orcsid realized that this was the [ | + | * Discord chat user DR orcsid realized that this was the [https://endgame-arg.wikia.com/wiki/Binge exact same puzzle used in the endgame ARG]. The number correspond to the brightness of the stars |
1.51 - Adara | 1.51 - Adara | ||
| Line 611: | Line 638: | ||
So, we have another task for you. | So, we have another task for you. | ||
We may have found the website Laeticia uses to communicate with her people. | We may have found the website Laeticia uses to communicate with her people. | ||
| − | + | https://happycats.club/ | |
Hidden somewhere on that site should be the proof that this website belongs to her people. | Hidden somewhere on that site should be the proof that this website belongs to her people. | ||
| Line 721: | Line 748: | ||
* This sentence was interpreted as [https://en.wikipedia.org/wiki/Vatican_City Vatican City, the site of the Holy See] | * This sentence was interpreted as [https://en.wikipedia.org/wiki/Vatican_City Vatican City, the site of the Holy See] | ||
| − | * A new image was found called vaticancity.png. This was quickly determined to be a phrase written in [ | + | * A new image was found called vaticancity.png. This was quickly determined to be a phrase written in [https://lotr.wikia.com/wiki/Dwarf_Runes Cirth, a dwarven runic alphabet from Lord of the Rings]. Discord User -kyoto transcribed it into English text. |
wherewillthemeetingbeheld | wherewillthemeetingbeheld | ||
| Line 750: | Line 777: | ||
* According to History of the Knights Templar, the [https://en.wikipedia.org/wiki/Philip_IV_of_France French king Phillip IV] pressured all the kingdoms of Europe into persecuting the Templars, except for Portugal and Scotland. As a result, many Templars who were able fled Europe to Scotland. | * According to History of the Knights Templar, the [https://en.wikipedia.org/wiki/Philip_IV_of_France French king Phillip IV] pressured all the kingdoms of Europe into persecuting the Templars, except for Portugal and Scotland. As a result, many Templars who were able fled Europe to Scotland. | ||
| − | |||
==February 5th, 2016 - The Plot Thickens== | ==February 5th, 2016 - The Plot Thickens== | ||
| Line 818: | Line 844: | ||
Hold on. | Hold on. | ||
| − | * /u/Tonywan followed up on his message with the following message, which contained [ | + | * /u/Tonywan followed up on his message with the following message, which contained [https://i.imgur.com/0hswdKk.jpg the next puzzle]. |
Since you seem to be on a roll (yes, I'm being ironic), do you mind solving this piece of paper we found in the holding cell we were holding L in? | Since you seem to be on a roll (yes, I'm being ironic), do you mind solving this piece of paper we found in the holding cell we were holding L in? | ||
| − | + | https://imgur.com/0hswdKk | |
* Teragon operatives produced a cleaner version of the map | * Teragon operatives produced a cleaner version of the map | ||
| − | + | https://i.imgur.com/siIhga0.png | |
Our people created a new, cleaned-up version of the map. | Our people created a new, cleaned-up version of the map. | ||
| − | + | https://i.imgur.com/siIhga0 | |
* Discord User karp suggested that the path taken through the streets was to be "added" when going right and "subtracted" when going left (from the perspective of the traveler), based on the zoom bar at the top. To add, simply append the street name to the end of the current text. To subtract, remove any letters that are shared with the street name from the current text. For example, "AB" + "CD" = "ABCD". "ABCD - DE" = "ABC". This process results in the following sequence. | * Discord User karp suggested that the path taken through the streets was to be "added" when going right and "subtracted" when going left (from the perspective of the traveler), based on the zoom bar at the top. To add, simply append the street name to the end of the current text. To subtract, remove any letters that are shared with the street name from the current text. For example, "AB" + "CD" = "ABCD". "ABCD - DE" = "ABC". This process results in the following sequence. | ||
| Line 913: | Line 939: | ||
* Yesterday.pdf pointed to a cryptic document of a meeting with a psychiatrist. | * Yesterday.pdf pointed to a cryptic document of a meeting with a psychiatrist. | ||
| − | * Congratulations2.txt in the inquiry director was updated by JM, containing [ | + | * Congratulations2.txt in the inquiry director was updated by JM, containing [https://strawpoll.me/6738018 this strawpoll] |
Thank you for helping us with that code. | Thank you for helping us with that code. | ||
| Line 919: | Line 945: | ||
We have one hour before we issue security clearances for the translators contracted by Linguis. Based on what you found, we can safely assume that one of them is working for FDM. Unfortunately, at this point, we have no idea which one it is. In the folder that contains this message, you will find a file listing those individuals along with whatever we have been able to find about them. | We have one hour before we issue security clearances for the translators contracted by Linguis. Based on what you found, we can safely assume that one of them is working for FDM. Unfortunately, at this point, we have no idea which one it is. In the folder that contains this message, you will find a file listing those individuals along with whatever we have been able to find about them. | ||
We do have a lead, however. Someone found a code that may lead you to the identity of the fake translator. | We do have a lead, however. Someone found a code that may lead you to the identity of the fake translator. | ||
| − | When you have his or her name, vote for that person's name at | + | When you have his or her name, vote for that person's name at https://strawpoll.me/6738018. |
The translator with the highest number of votes will be shot. | The translator with the highest number of votes will be shot. | ||
No, just kidding. We'll just deny his or her clearance, which will prevent them from working on Sunday. | No, just kidding. We'll just deny his or her clearance, which will prevent them from working on Sunday. | ||
| Line 1,047: | Line 1,073: | ||
"A type of half sentient plant cultivated by half sentient wizards". | "A type of half sentient plant cultivated by half sentient wizards". | ||
| − | * Discord Users believed this to refer to a Dota 2 in-game item, the [ | + | * Discord Users believed this to refer to a Dota 2 in-game item, the [https://dota2.gamepedia.com/Observer_Ward Observer Ward]. |
* Discord User goblingob combined "observer ward", "+50", and "+70" to discover observerward120.txt on Laeticia's website, which had the following content. | * Discord User goblingob combined "observer ward", "+50", and "+70" to discover observerward120.txt on Laeticia's website, which had the following content. | ||
| Line 1,058: | Line 1,084: | ||
Follow the way of the same bill again. Go visit Barbara and turn your back to her. Turn right and continue until the end of the street. Turn left and, once you find a decent place to buy the latest fashion from London, turn left again. Turn right and take a rest with the good doctor in front of the Eiffel tower. | Follow the way of the same bill again. Go visit Barbara and turn your back to her. Turn right and continue until the end of the street. Turn left and, once you find a decent place to buy the latest fashion from London, turn left again. Turn right and take a rest with the good doctor in front of the Eiffel tower. | ||
| − | * Discord chat users interpreted the hints as street names in Paris, and found [https://www.google.com/maps/@48.8734242,2.3059738,3a,75y,82.14h,72.07t/data=!3m6!1e1!3m4!1s3Qj3svGrJDKsJE0eRp1LLw!2e0!7i13312!8i6656 an x sign at Hotel California] at the [ | + | * Discord chat users interpreted the hints as street names in Paris, and found [https://www.google.com/maps/@48.8734242,2.3059738,3a,75y,82.14h,72.07t/data=!3m6!1e1!3m4!1s3Qj3svGrJDKsJE0eRp1LLw!2e0!7i13312!8i6656 an x sign at Hotel California] at the [https://postimg.org/image/gy8n915yv intersection of the two points of the road]. |
* Discord User Jack messaged the location to /u/Tonywan, and received the following response. | * Discord User Jack messaged the location to /u/Tonywan, and received the following response. | ||
| Line 1,071: | Line 1,097: | ||
Great work, Sherlock. Please try again and this time, PLEASE BE ACCURATE | Great work, Sherlock. Please try again and this time, PLEASE BE ACCURATE | ||
| − | * A second attempt by the Discord chat resulted in identifying the center of a cross [ | + | * A second attempt by the Discord chat resulted in identifying the center of a cross [https://postimg.org/image/c1fixu2jb generated by the two paths] |
* Discord User HerrMyth provided live geographic intelligence from the scene in Paris. | * Discord User HerrMyth provided live geographic intelligence from the scene in Paris. | ||
| Line 1,079: | Line 1,105: | ||
Report from our TAC team: nothing suspicious whatsoever. The beds are fluffy, though. | Report from our TAC team: nothing suspicious whatsoever. The beds are fluffy, though. | ||
| − | * A third attempt at Discord chat was able to [ | + | * A third attempt at Discord chat was able to [https://i.imgur.com/qW5mBnD.png refine the cross] to center at [https://imgur.com/hMDxe6F) 27 Rue de Berri] Photo credit to Agent HerrMyth |
* /u/Tonywan gave the following response after being notified of the new location. | * /u/Tonywan gave the following response after being notified of the new location. | ||
| Line 1,104: | Line 1,130: | ||
While our TAC team is still trying to find clues at the location, we have a new task for you guys, if you're up for it. | While our TAC team is still trying to find clues at the location, we have a new task for you guys, if you're up for it. | ||
| − | There seems to be something over at | + | There seems to be something over at https://happycats.club/g.txt |
Can you investigate? | Can you investigate? | ||
JM | JM | ||
| Line 1,183: | Line 1,209: | ||
We didn't betray you. | We didn't betray you. | ||
We are doing what we have to do. | We are doing what we have to do. | ||
| − | Make up your mind. You have one hour. | + | Make up your mind. You have one hour. https://strawpoll.me/6744112 |
| − | * At the end of the alotted period, the option "Stay with Teragon" won the [ | + | * At the end of the alotted period, the option "Stay with Teragon" won the [https://strawpoll.me/6744112/r poll] 216 to 189, amid heavy suspicions of voter fraud. |
* The inquiry directory was updated to include the following files. | * The inquiry directory was updated to include the following files. | ||
| Line 1,214: | Line 1,240: | ||
PS2: Think about the places people on the Internet go to when they want to buy stuff from private individuals. I doubt they would buy that stuff from a company, that leaves a paper trail. | PS2: Think about the places people on the Internet go to when they want to buy stuff from private individuals. I doubt they would buy that stuff from a company, that leaves a paper trail. | ||
| − | * Discord user pastoras discovered this [ | + | * Discord user pastoras discovered this [https://paris.craigslist.fr/wan/5436462949.html?lang=en&cc=gb Craigslist listing], referring to Methylphosphonyl Difluoride, a chemical weapon precursor. A screenshot of the listing can be seen [https://i.imgur.com/QFMsHxU.png here]. |
* newwork.txt was added to the inquiry directory with the following content. | * newwork.txt was added to the inquiry directory with the following content. | ||
| Line 1,227: | Line 1,253: | ||
* Discord user fillard found a hidden image inside the cat image using steganography. | * Discord user fillard found a hidden image inside the cat image using steganography. | ||
| − | * Discord user Kaglicious identified [ | + | * Discord user Kaglicious identified [https://i.imgur.com/voh3LUi.png the hidden image] as a [https://www.dcode.fr/dancing-men-cipher dancing man cipher from Sherlock Holmes] |
| − | * Discord user DevonMC discovered that [ | + | * Discord user DevonMC discovered that [https://i.imgur.com/voh3LUi.png this dancing man cipher] was mirrored from the original |
* Discord chat was able to decipher the cipher to obtain the text | * Discord chat was able to decipher the cipher to obtain the text | ||
| Line 1,243: | Line 1,269: | ||
* The inquiry directory was updated with a new upcoming.txt with the following content. | * The inquiry directory was updated with a new upcoming.txt with the following content. | ||
| − | + | https://happycats.club | |
New post | New post | ||
Get on it right now. | Get on it right now. | ||
| Line 1,252: | Line 1,278: | ||
1225424453544455522344542123543442343255345345422521532533254245555331342453444325442522253144522554444344525244122154113452542513 | 1225424453544455522344542123543442343255345345422521532533254245555331342453444325442522253144522554444344525244122154113452542513 | ||
| − | * Discord Users hex010 recognized the cipher as a [https://en.wikipedia.org/wiki/Polybius_square polybius square], and solved it with the following key as seen [ | + | * Discord Users hex010 recognized the cipher as a [https://en.wikipedia.org/wiki/Polybius_square polybius square], and solved it with the following key as seen [https://s28.postimg.org/5fh7njg71/Screenshot_060216_21_19_56.png here]. |
VWXYZABCDEFGHIJKLMOPQRSTU | VWXYZABCDEFGHIJKLMOPQRSTU | ||
| Line 1,302: | Line 1,328: | ||
===A New Ally...=== | ===A New Ally...=== | ||
| − | * At exactly 3PM CET, we were greeted by JM with [ | + | * At exactly 3PM CET, we were greeted by JM with [https://web.archive.org/web/20160207144904/https://teragongroup.com/inquiry/FromJM.txt this] message: |
Hi guys, | Hi guys, | ||
| Line 1,314: | Line 1,340: | ||
PS: Today is Renee's birthday. Don't forget to wish her a happy birthday, I know she'll love it! | PS: Today is Renee's birthday. Don't forget to wish her a happy birthday, I know she'll love it! | ||
| − | * We then received a [ | + | * We then received a [https://web.archive.org/web/20160207143916/https://teragongroup.com/inquiry/FromRenee.txt message] from Renee: |
| Line 1,329: | Line 1,355: | ||
brrrb | brrrb | ||
| − | * After Renee had to run off, another [ | + | * After Renee had to run off, another [https://web.archive.org/web/20160207144031/https://teragongroup.com/inquiry/FromJM2.txt message from JM] was recieved: |
Hey guys, | Hey guys, | ||
| Line 1,349: | Line 1,375: | ||
About the garage: our team found some suspicious vehicles in there. | About the garage: our team found some suspicious vehicles in there. | ||
I'll upload a list of pictures. Look at them and choose the one that you think we should break into and search. | I'll upload a list of pictures. Look at them and choose the one that you think we should break into and search. | ||
| − | + | https://strawpoll.me/6751370 | |
You have 10 minutes to give your answer. Oh, and because you seem to enjoy manipulating votes (wouldn't really expect anything else from traitors, would we?), we added some captcha thing to the strawpolls. Hopefully, you're better at solving CAPTCHAS than at solving ciphers. | You have 10 minutes to give your answer. Oh, and because you seem to enjoy manipulating votes (wouldn't really expect anything else from traitors, would we?), we added some captcha thing to the strawpolls. Hopefully, you're better at solving CAPTCHAS than at solving ciphers. | ||
Tony | Tony | ||
| Line 1,355: | Line 1,381: | ||
| − | * The directory was updated with cars.rar ([ | + | * The directory was updated with cars.rar ([https://imgur.com/a/YnXjJimgur album with contents]). |
* Discord chat quickly figured the suspicious vehicle to be a Volkswagen Touran, the same vehicle from yesterday's stickman code. | * Discord chat quickly figured the suspicious vehicle to be a Volkswagen Touran, the same vehicle from yesterday's stickman code. | ||
| Line 1,374: | Line 1,400: | ||
https://www.youtube.com/watch?v=rSzRaZzMqPQ | https://www.youtube.com/watch?v=rSzRaZzMqPQ | ||
| − | * The video has four messages coded inside. These codes were used to rule out other suspects and select #4 from a .rar folder of pictures uploaded to the inquiry directory, the images of which you can [ | + | * The video has four messages coded inside. These codes were used to rule out other suspects and select #4 from a .rar folder of pictures uploaded to the inquiry directory, the images of which you can [https://imgur.com/a/NVh9K viewed here] |
* The inquiry directory was then updated with FromTony2.txt, which contained the following message: | * The inquiry directory was then updated with FromTony2.txt, which contained the following message: | ||
| Line 1,432: | Line 1,458: | ||
Time for your last task: finding and neutralising the threat. | Time for your last task: finding and neutralising the threat. | ||
First, since you failed miserably at deciphering the clue, we'll need to find the room. | First, since you failed miserably at deciphering the clue, we'll need to find the room. | ||
| − | Vote here: | + | Vote here: https://strawpoll.me/6753987 |
You have five minutes. If you fail, I will ask the question again. So, every time you guess wrong, you basically lose 5 minutes out of the hour you have to neutralize the threat. | You have five minutes. If you fail, I will ask the question again. So, every time you guess wrong, you basically lose 5 minutes out of the hour you have to neutralize the threat. | ||
Please try to use your brain cells this time. | Please try to use your brain cells this time. | ||
| Line 1,444: | Line 1,470: | ||
We did find something: brooms, napkins and a dead mouse. | We did find something: brooms, napkins and a dead mouse. | ||
No bomb, though. | No bomb, though. | ||
| − | + | https://strawpoll.me/6754066 | |
* After voting incorrectly for "the office next to the meeting room", Tony updated the inquiry directory with FromTony3.txt. | * After voting incorrectly for "the office next to the meeting room", Tony updated the inquiry directory with FromTony3.txt. | ||
| Line 1,450: | Line 1,476: | ||
We looked inside the office room. | We looked inside the office room. | ||
Nada. Nothing. Zilch. Rien. | Nada. Nothing. Zilch. Rien. | ||
| − | + | https://strawpoll.me/6754123 | |
* After voting incorrectly for "kitchen", Tony updated the inquiry directory with FromTony4.txt. | * After voting incorrectly for "kitchen", Tony updated the inquiry directory with FromTony4.txt. | ||
| Line 1,456: | Line 1,482: | ||
ARE YOU KIDDING ME? DO YOU SECRETLY WANT TO GET ME KILLED? | ARE YOU KIDDING ME? DO YOU SECRETLY WANT TO GET ME KILLED? | ||
THERE'S NOTHING IN THAT KITCHEN!!!! | THERE'S NOTHING IN THAT KITCHEN!!!! | ||
| − | + | https://strawpoll.me/6754182 | |
* After voting correctly for "lunch break area", Tony updated the inquiry directory with Defusing.txt. | * After voting correctly for "lunch break area", Tony updated the inquiry directory with Defusing.txt. | ||
| Line 1,483: | Line 1,509: | ||
* Discord user Trialtrex21 deciphered cipher.txt using Atbash, resulting in the following text, identified to be French song, Ave Maria. | * Discord user Trialtrex21 deciphered cipher.txt using Atbash, resulting in the following text, identified to be French song, Ave Maria. | ||
| − | * Discord Users DevonWC, Pan Heath and W4nn4be used the [ | + | * Discord Users DevonWC, Pan Heath and W4nn4be used the [https://www.dcode.fr/ave-maria-tritheme Ave Maria cipher] to obtain following English text. |
THE VERY LONG CABLE IS GREEN | THE VERY LONG CABLE IS GREEN | ||
| Line 1,505: | Line 1,531: | ||
Vote here before 8PM. | Vote here before 8PM. | ||
| − | + | https://strawpoll.me/6754367 | |
I will cut the cable with the most votes at 8PM | I will cut the cable with the most votes at 8PM | ||
Our director has now been evacuated to a safe location. He will leave his final report in the /inquiry/ directory at 8:15PM at the latest to tell you what happened. | Our director has now been evacuated to a safe location. He will leave his final report in the /inquiry/ directory at 8:15PM at the latest to tell you what happened. | ||
| Line 1,511: | Line 1,537: | ||
===The Conclusion=== | ===The Conclusion=== | ||
| − | * At the conclusion of the [ | + | * At the conclusion of the [https://strawpoll.me/6754367/r poll], the Discord chat decided incorrectly to cut the red wire. |
* The correct solution can be [https://imgur.com/DYro32B viewed here] | * The correct solution can be [https://imgur.com/DYro32B viewed here] | ||
Latest revision as of 00:57, 6 June 2018
| Teragon | |
|---|---|
| Type | Unofficial |
| Creator | gayfarang |
| Discovered | 2016-01-31 |
Main Page > List of Investigations > Teragon
The Teragon ARG was made by gayfarang. It followed the story of an agency named Teragon, whose goal was to protect the world against a nefarious group of terrorists. Teragon was followed by the EFS ARG.
Contents
January 31st, 2016 - Beginnings
The 4chan Post
An anonymous 4chan user posted a message to the Dota 2 General thread of /vg/ (/d2g/), which read:
what the hell? There's something very weird going on here: https://www.youtube.com/channel/UChbNByMTjZnnqJAMPkvD_vg/videos? sort=dd&view=0&shelf_id=0
The YouTube channel contained 40+ short, cut-and-looped videos of professional Dota 2 player EternaLEnVy (aka EE) being interviewed, each featuring a one-word title as well as a title screen before the looped clip.
After seeing the YouTube link while browsing /d2g/, A Reddit user made a post on /r/dota2 about it.
A Mysterious Entity
Other Reddit users posting in the thread noticed every title screen & description of every video linked to the channel's sponsor, teragongroup.com, a strange website which describes itself as "Shaping the World of Tomorrow" and promotes "Services" such as "Consulting", "Intelligence Analysis", and "Surveillance". A filename, areyouworthy.txt, was also discovered at the very bottom of the webpage.
By adding areyouworthy.txt to the end of the website's URL, the following text was discovered:
Alone on the river bank, Peter counted his money. Somehow, only 12 gold coins were left. How was it possible? Surely, he couldn't have spent that much money. A duck and two rabbits were the only items Peter had bought that week. After subtracting the price of those three items from Peter's weekly pay, at least 30 gold coins should have remained in his pocket. Now, what should Peter do? His 12 gold coins won't be enough to live on for the rest of the month. Should he weep, should he beg or should he steal? The day was nearly over. Sulking, Peter decided to go home. On the road, an old man came to him. Incredibly, that old man had found Peter's missing money on the side of the road earlier in the day and wanted to hand it back to him! Moving swiftly, Peter grabbed the knife hidden in his satchel and stabbed the old man in the heart. Now, with his missing coins and the old man's savings in his pockets, Peter walks back home with a contented smile on his face. What is Peter's favorite Dota2 hero?
The Second Message
Another Reddit user pointed out that the letters at the start of each line are "APSHSAANSTSOIMN", which is an anagram of "Phantom Assassin", a Dota 2 character. Following the precedent of adding to the end of the website's URL, players were able to access phantomassassin.txt, which contained the following:
Teragon Group is currently looking for a M/F field asset: JOB DESCRIPTION Field assets are responsible for conducting surveillance and clandestine operations throughout the world, at the sole request of the Teragon Group board members. REQUIREMENTS Applicants should: - Be at least 18 years of age. - Be in excellent physical and mental health. - Not be members or descendants of members of occult societies, incl.: The Freemasonry, the Rosicrucian Order or the Society of Jesus. hp htww cpdslap esp hzcwo XI
Yet another Reddit user figured out how to decrypt the ROT11, which, once decrypted, reads "we will reshape the world". Another file, named wewillreshapetheworld.txt, was then discovered, reading:
On June 20th 1307, just before dawn, three men entered the private offices of the King in the Palace of Fontainebleau. They gave Philip IV everything he needed to take down the only group of people with both the military and financial means to threaten his reign. In exchange for the betrayal of their brothers, the three men were awarded a tenth of the considerable fortune of the soon-to-be-eradicated order. Thus was Teragon born ulnjwysearstspfgjnkf
February 1st, 2016 - Call and Return
A New URL
One Reddit user came across a new URL, /betrayalwasnecessary.png, and discovered an image of Baphomet.
More Information
Another Reddit user discovered that the encrypted text in wewillreshapetheworld.txt was a Vigenere cipher with the passphrase "This was Teragon born". Once decrypted, the text read betrayalwasnecessary. Since a player had already found that URL, focus switched to the image on the page.
One player pointed out that the depiction of Baphomet found on the betrayalwasnecessary page was known as the "Dogme et Rituel de la Haute Magie" (English: Dogma and Ritual of High Magic), and it derived from two books by French occult author & ceremonial magician Eliphas Levi, namely "Dogme" and "Rituel". Another player ran the image through a steganography tool and revealed the following text hidden within:
The old order had become weak and corrupt. It needed to be cleansed. From one point of view, a betrayal. From another, a salvation. joinus
A Message is Sent
With the search for new "joinus" URL failing, participants began to speculate that the phrase might be directing them to "apply" to the Teragon Group. This led a number of participants to emails "applications" to the email listed on the bottom of the webpage, [email protected]
- Several hours later, two of the players who had sent applications received identical email responses, which both read:
We are sorry to inform you that, based on the information found in our files regarding your education and professional backgrounds, we will not be able to take your application into consideration. Kind regards, JM, Teragon Group, Human Resources Department Sous son règne, la France était grande et les Français malheureux. `******|||||||||**||***||****|****||||***||******||**||||||`
In English, the French sentence read:
Under his reign, France was great and the French unfortunate.
One Reddit user pointed out that "JM" is very likely "Jacque de Molay". He also noted that the French signature is a quote from the book "Le Roi de fer" (English: "The Iron King"), which is the first in a series of books about the French monarchy known as "Les Rois Maudits" (English: "The Accursed Kings"), penned by French author Maurice Druon starting in 1955.
- The particular excerpt in question,
Sous son règne, la France était grande et les Français malheureux., comes from the first page of the prologue of "Le Roi de fer", and refers to the state of the French kingdom under the rule of Phillipe (le Bel) IV. From Wikipedia:
Set during the reigns of the last five kings of the Capetian dynasty and the first two kings of the House of Valois, the series begins as the French King Philip the Fair, already surrounded by scandal and intrigue, brings a curse upon his family when he persecutes the Knights Templar. The succession of monarchs that follows leads France and England to the Hundred Years' War.
February 2nd - Watching the Watcher
A Wild Video Appears
Sometime in the morning, the Baphomet Studios Youtube channel uploaded a 2:06 video titled "Pawn," but removed it 15 minutes later. One Reddit user managed to mirror the video before it was taken down. The audio in the video consists of a man speaking in French, which a user pointed out is a reading of the prologue of "Le Roi de fer".
Later in the day, Baphomet Studios hosted a YouTube livestream which lasted for 7:45 minutes. The entire video consists of only one image, that of Edward I paying homage to King Philip IV of France. The audio in the beginning of the livestream appears to be identical to the audio in the "Pawn" video. Halfway through, the audio cuts to a slowed down speech similar to the Acre video.
More Emails
Simultaneous to the livestream, the Teragon Group began responding to more application emails. Many people received a response which read:
We regret to inform you that, based on our assessment, you do not seem to have the skills required for the field asset position. We will nevertheless keep your application stored in our database should you prove us wrong at a later stage. Kind regards, TN, Recruitment Manager Teragon Group "Shaping the World of Tomorrow" New-York Headquarters: 501/504C, 30 Vesey Street, NY 10007 Email: [email protected] BTC: 1NPa6HZfH1ywZafCoMoQJg4t22MT45byuu Sous son règne, la France était grande et les Français malheureux. xxxxxxoooooooooxxooxxxooxxxxoxxxxooooxxxooxxxxxxooxxoooooo
Shortly thereafter, Baphomet Studios uploaded this video, which showed participants that the symbols didn't matter, only the pattern did, and also affirmed that the code was based on "Le Roi de fer" (LRDF).
Simultaneously, the Teragon Group webpage updated to display the following under "Latest":
xxxxxxooooooooo xxoo xxxoo xxxxo xxxxoooo xxxoo xxxxxxoo xxoooooo
This clue directed participants to read the numbers in the video as pairs, which led to the theory that they were line and character coordinates to be applied within "Le Roi de fer".
Activate the Cipher!
Sometime during the chaos generated by the videos, the Teragon Group website was updated, and displayed the following sequence of numbers in its footer:
69 22 32 41 44 32 62 26
One Discord user discovered that these numbers could be applied as a book cipher to the prologue of "Le Roi de fer." Taking each number to be a pair of values - the first being a line number, and the second the n^th letter in a line (ie 69 = line 6, letter 9, etc.) - this image of the prologue can be used in combination with the cipher to reveal to word continue.
Press Any Key to Continue
One Discord user experimented with several different file extensions searching for a new URL based on "continue", eventually arriving at a new URL of an audio file, continue.mp3. This audio file consisted of a text-to-speech recording of series of letters, which were:
qrfhycthhcsj hehbdahhjvozzyenv uxqyhhwaaecxamexywnhtykyqzjwzpareezzqrbdde uhbsbhyqzrdlds
Discord users downloaded the mp3 file and looked through the metadata to find the name and artist of the file, which were "ultimate" and "power" respectively. This led users to believe that the above text was a keyed Vigenere cipher and, using an alphabet key of "ultimate" and a passphrase of "power," the text was decoded to:
likeaphoenix ourorderwasreborn betterandunencumberedbytheweightofreligion followthetrail
Coming Soon...
Through trial-and-error, Discord users discovered another file, followthetrail.txt. When initially discovered, it displayed the text "Coming soon.". Within minutes, the file was updated to read:
Extract from page 87 of the personal diary of Luc Delorme: September 13th, 1948. It’s been six weeks now since I’ve seen Anne and the kids. Six weeks since she stormed out of the apartment, Michel and Laeticia in tow, yelling “You’re going crazy, Luc! And the worst part is, you don’t even see it. But I won’t stand here while you destroy this family!” She was wrong, though. I’m not crazy. Maybe just slightly… obsessed. All in all, it’s for the better, I suppose. Working on the files has become much easier now, with the apartment to myself. This morning, went to my appointment with Pr. Halphen at La Sorbonne. I told him everything. The nine founders of the Templar Order and their mysterious connection to the newly-crowned King of Jerusalem. The cover story concocted by those nine men and the King. “Protecting the roads of the Holy Land.” Ha! As if nine men could secure hundreds of kilometers of roads! Their well-documented nighttime excavations under the Temple of Solomon, followed by their meteoric rise to power. They had found something, that much was clear. Something that gave them wealth and power beyond measure. It all made sense. I knew that Professor Halphen was going to see it, just as I myself saw the light before. But he laughed. That idiot, that stubborn fool laughed me right out of his office. He will see, though. One day, he will see. And he will remember bitterly the day he laughed at my theories. Time to get back to work. I still have to decipher that parchment. I may have to take a break, though. My arm is starting to hurt. As I was leaving the office of Pr. Halphen, a young man bumped into me. He must have had something sharp on him because something tore my sleeve and scratched my skin. There was something that felt familiar about that young man. Had I seen him before? Anyway, let’s go and put some iodine on that scratch (it’s turning a weird shade of blue!) and then get back to our documents.
Shortly after the discovery of followthetrail.txt, a Discord user discovered another file, parchment.png, by experimenting with a line from followthetrail.txt, Time to get back to work. I still have to decipher that parchment.
The file parchment.png consisted of multiple sentence fragments and numbers scattered around. Clockwise from the top, the text portion reads:
the amazing beauty of the page and date significance of the
From left to right, the numbers in parchment.png read:
11 11 17 41 67 51 24 2
February 3rd, 2016 - A Leaky Ship
Parchment Breakthough
Through use of the text from parchment.png, the page number (87) and date (September 13th, 1948) from followthetrail.txt, Discord users discovered the number 8709131948. This led players to the file 8709131948.pdf. However, the purpose of the .pdf remained unclear. After the discovery of 8709131948.pdf, the footer of the "Latest" page updated to read OWLEYES.
Shortly after this discovery, a player leaked the complete index of the Teragon website. Immediately after the leak, the Teragon Group went dark, displaying only a brief message about "fixing a security leak", and all files became inaccessible. After about 5 minutes, the site came back online, with a new message in its footer which read:
All leaks have now been fixed. The people responsible for leaking private information will be hunted down.
The Leaked Bounty
Among the URLs on the leaked index, a new file, anewbeginning.png was discovered, displaying a message in Flag Semaphore code, which was translated to donotdespair. This led players to donotdespair.txt, which read:
Hang in there. We can't give you clues but know that we are cheering for you. We have to go into hiding. Come back here when you've found valuable information.
Mister... Wan...
At some point during the chaos caused by the leak, a theory was formulated, based on "messages from Laetitia told us to speak with him, because he was an Teragon operative", that Reddit user /u/TonyWan, the user who solved the Phantom Assassin clue, was, in fact, involved with the Teragon Group.
A Reddit user sent /u/TonyWan a private message, which read:
Hello, Mr. Tony. You may know me as JM. Be wary that you are being investigated by ISSP as a possible part of the leak on our website. You better share with us what you know.
/u/TonyWan later replied:
This is highly suspicious. Why would JM contact me here and not on our Intranet? Okay, if you really are who you say you are, let's try something. Every year in March, we celebrate the anniversary of the brightest day of our organization in front of a plaque. Over the plaque is a bridge. Cross the bridge, what is the name of the building to your left? Visit the file named after that building.
Samaritaine
It was deduced that the bridge referred to by /u/TonyWan was the Pont Neuf, as the bridge is across from a plaque memorializing De Molay's death located by the Seine River. Across the Pont Neuf bridge and to the left is a department store named "Samaritaine." This clue led players to a new file, samaritaine.png. Through the use of an Enigma machine simulator with rotors set according to samarataing.png and an input of RCTHHONEMPKMG<code>, a new file, titled <code>hiddenhistory.mp3 was discovered.
Players quickly discovered that the audio file contained a message in Morse. Converting the Morse Code to base64, then the base64 to hex, then the hex to md5, allows one to decipher to word Administrator.
This led players to the file administrator.txt, which contained the following series of numbers:
01917 22334 65111 33610 14011 10500 55316 11391 31515 12011 54111 42011 34799 60005 53313 16005 03036 31681 40381 30220 33189 51269 41014 00074 35210 13380 55627
Players used a cipher with the passphrase "Giving You a Better World" (phrase found on Teragon Group's webpage) on administrator.txt and revealed the following message:
OUR GOAL IS NEAR IT IS WITHIN OUR GRASP SOON WE WILL ACCOMPLISH OUR LOFTY GOALSTAYSTRONGD
Initially, this clue lead players to the file staystrong.png on the Teragon website, but quickly became inaccessible. This led players to the file staystrong.txt, which contained a link to an unlisted YouTube video on the Baphomet Studio channel of footage of a harbor.
Vive La Rochelle!
Discord users quickly realized that all the locations filmed in the video linked in staystrong.txt were in the city of La Rochelle, France. This led players to a new file, larochelle.txt, which read:
122 105 153 154 115 152 102 103 122 123 61 125 123 60 106 111 112 124 111 167 125 60 126 112 125 171 125 171 115 105 112 106 114 126 122 114 121 125 147 154 115 152 102 104 123 105 105 164 122 60 126 106 112 124 111 167 121 153 125 164 126 105 164 102 123 103 125 171 115 105 65 102 125 60 147 164 122 105 71 112 122 123 61 125 125 60 70 154 115 152 102 125 125 60 125 164 124 153 154 115 124 103 125 171 115 105 122 112 121 153 126 111 112 124 111 167 121 123 61 130 124 60 147 154 115 152 102 103 122 123 61 125 123 60 106 111 112 124 111 167 122 105 154 103 122 125 147 154 115 152 102 125 123 105 106 117 114 126 160 112 122 123 125 171 115 105 122 141 122 125 147 154 115 152 102 104 124 105 105 164 122 60 153 164 121 125 154 111 112 124 111 167 121 153 125 164 126 105 164 102 123 103 125 171 115 105 112 112 123 103 61 125 125 60 125 164 122 105 154 111 112 124 111 167 121 153 125 164 126 105 164 102 123 103 125 171 115 105 116 111 121 123 61 110 122 125 125 154 115 152 102 103 122 123 61 125 123 60 106 111 112 124 111 167 126 106 116 102 114 125 125 164 122 105 71 117 123 125 64 164 122 125 125 154 115 152 102 102 114 125 116 111 123 123 125 171 115 105 122 102 123 103 61 117 122 126 115 164 126 106 116 102 112 124 111 167 123 60 170 106 125 60 147 154 115 152 102 105 114 125 106 111 112 124 111 167 121 153 125 164 126 105 164 102 123 103 125 171 115 105 65 102 125 60 147 164 122 105 71 112 122 123 61 125 125 60 70 154 115 152 102 102 123 103 61 113 121 125 147 154 115 152 102 114 124 105 126 124 123 103 125 171 115 105 164 115 122 126 116 111 112 124 111 167 124 153 125 164 121 125 150 124 114 125 160 102 123 103 125 171 115 106 122 124 121 125 147 154 115 152 101 154 115 152 102 103 122 123 61 125 123 60 106 111 112 124 111 167 126 106 116 106 114 125 65 112 124 105 167 154 115 152 102 105 121 125 147 164 124 153 126 124 114 126 122 124 121 123 125 171 115 105 106 111 114 125 65 102 123 103 125 171 115 106 122 124 121 125 147 164 121 126 115 164 127 153 154 111 112 124 111 167 124 153 125 164 121 125 150 124 114 125 160 102 123 103 125 171 115 106 116 111 123 123 61 105 121 123 125 171 115 105 106 111 114 125 170 120 125 61 157 154 115 152 102 102 123 103 61 117 121 125 147 154 115 152 102 103 122 123 61 115 121 123 61 124 121 125 65 102 112 124 111 167 121 60 150 112 124 153 122 112 112 124 111 167 126 106 116 102 123 103 61 102 125 171 61 141 123 125 147 75
Players quickly realized that the text contained in larochelle.txt was octal, and decoded to:
REklMjBCRS1US0FIJTIwU0VJUyUyMEJFLVRLQUglMjBDSEEtR0VFJTIwQkUtVEtBSCUyME5BU0gtRE9JRS1UU08lMjBUU0UtTklMTCUyMERJQkVIJTIwQS1XT0glMjBCRS1US0FIJTIwRElC RUglMjBUSEFOLVpJRSUyMERaRUglMjBDTEEtR0ktQUlIJTIwQkUtVEtBSCUyMEJJSC1UU0UtRElIJTIwQkUtVEtBSCUyMENIQS1HRUUlMjBCRS1US0FIJTIwVFNBLUUtRE9OSU4tRUUlMjBBL UNISSUyMERBSC1ORVMtVFNBJTIwS0xFU0glMjBELUFIJTIwQkUtVEtBSCUyME5BU0gtRE9JRS1UU08lMjBBSC1KQUglMjBLTEVTSCUyMEtMRVNIJTIwTkUtQUhTLUpBSCUyMFRTQUglMjAlMj BCRS1US0FIJTIwVFNFLU5JTEwlMjBEQUgtTkVTLVRTQSUyMEFILU5BSCUyMFRTQUgtQVMtWklIJTIwTkUtQUhTLUpBSCUyMFNISS1EQSUyMEFILUxPU1olMjBBSC1OQUglMjBCRS1MQS1TQU5 BJTIwQ0hJTkRJJTIwVFNBSC1BUy1aSUg=
Players recognized this as base-64, which decoded to:
DI BE-TKAH SEIS BE-TKAH CHA-GEE BE-TKAH NASH-DOIE-TSO TSE-NILL DIBEH A-WOH BE-TKAH DIBEH THAN-ZIE DZEH CLA-GI-AIH BE-TKAH BIH-TSE-DIH BE-TKAH CHA-GEE BE-TKAH TSA-E-DONIN-EE A-CHI DAH-NES-TSA KLESH D-AH BE-TKAH NASH-DOIE-TSO AH-JAH KLESH KLESH NE-AHS-JAH TSAH BE-TKAH TSE-NILL DAH-NES- TSA AH-NAH TSAH-AS-ZIH NE-AHS-JAH SHI-DA AH-LOSZ AH-NAH BE-LA-SANA CHINDI TSAH-AS-ZIH
Players recognized this message to be Navajo code, and translated to:
THIS IS THEY LAST STEP PREVIOUS THEY FIRST LESSON AREYOUREADY
This led players to the file areyouready.txt, which contained the following:
Have you remembered your lesson? A city and a pillar. 21946101621435413693530515
Shortly afterwards, the previously discovered donotdespair.txt updated to read:
We're monitoring your progress. You're doing great! Even faster than we expected! Go on, you're not very far now.
It was at this point that a player was able to decode the PDF from earlier using leftover numbers from parchment.png and a tridigital cipher. This discovery was made because the initial creator of the tridigital cipher had the username of "owleyes," which was an earlier clue. A Pastebin of the decoded document can be found here.
February 4th, 2016 - The Fuse Is Lit
Hard Work
Sometime overnight, the staystrong image was updated to show the roof of the Rosslyn Chapel, the same chapel that the pillar before was from.
In addition, donotdespair.txt was updated to read:
Give up now.
areyouready.txt was also updated to read:
Have you remembered your lesson? A city and a chapel. 21946101621435413693530515
It became clear that the key to the code wasn't the pillar, but actually the chapel that the pillar was in.
Known Teragon Operative /u/Tonywan made a Reddit post which suggested that a previously-used cipher was reused.
How humiliating it must be to twice be stumped by the same code.
/u/Tonywan made another post on Reddit, which linked to a board game on Amazon.
Still stumped? Aww. OK, I'm a pretty nice guy overall, so, if you want to, click here to get a clue: https://goo.gl/D5a5L3
The Baphomet Studios YouTube channel updated with a new video, featuring many depictions of the previously significant OWLEYES. This, combined with /u/Tonywan's post, and the hint "Have you remembered your lesson?" strongly suggested that another tridigital cipher was used for this code.
Using this information, a Discord user was able to decode areyouready.txt with the numerical key larochelle and the alphabetical key rosslyn to yield the plaintext message:
youdeserveanexplanation
Another Discord user then used this information to find the hidden directory youdeserveanexplanation/ on the Teragon website, leading to a wealth of new clues.
The Lord of Pits
The directory youdeserveanexplanation/ contained the following files:
>[BRIEFING-Leaks.pdf >[Confidentiality.txt Encrypted.rar MEETING PREPARATION.pptx MenuFeb04.pdf OurHistory - Page 106.pdf OurHistory - Pages 87-88.pdf departmentheads.xls notice.txt welcome.txt
Encrypted.rar, in particular, was of interest. At the same time, Laeticia updated donotdespair.txt to contain the code <ode>bdnsluosreladayr</code>
Discord users and Dota 2 fans realized identified this code as an anagram, and managed to unscramble it to obtain the password to Encrypted.rar:
abyssalunderlord
MapQuest is back!
The RAR archive was extracted to obtain the file xxx.txt:
The journey will bring you to the truth PLHUSKCZHR LYTDSDEG NGNECFSDSS SASYAEIQJO TDLYSDEG
A Discord user identified the code as a string of ISO country abbreviations. The code translated to:
poland, hungary, slovakia, czech republic, croatia libya, chad, sudan, egypt nigeria, niger, central african republic, sudan, south sudan saudi arabia, syria, united arab emirates, iraq, jordan chad, libya, sudan, egypt
These countries were then plotted out in order on a map to obtain the word HUMAN.
More Mapping!
Using the solved map code, human.txt was discovered on the website.
At first, the text file read:
By adding thEse two numbers together, you will read the truth. 355 292
Later on, human.txt was updated to read
48°50'01.0"N 2°22'32.8"E 355 + 292
A Discord user found that the coordinates to point to a Parisian library. Soon after this discovery, human.txt was updated to read:
40¡Æ45'13.2"N 73¡Æ58'58.8"W 355 + 292
This new set of coordinates pointed players to a library in New York. Again, human.txt was updated to read:
35°39'08.5"N 139°43'34.6"E 355 + 292
This set of coordinates pointed to a Tokyo library. Yet again, human.txt was updated to read:
12°02'54.2"S 77°01'43.1"W 355 + 292
This set of coordinates pointed to a location near a Lima library. Human.txt was updated another time to read:
26°12'16.0"S 28°02'21.4"E 355 + 292
This set of coordinates pointed to a Johannesburg library. Finally, human.txt was updated with this ominous message:
Dear recruits, We know what you are trying to do. (Did you think we were that blind?) I would like to talk to you, but unfortunately I'm a busy man and I'm afraid I can't wait forever. You have one hour to find the solution to this little problem. It shouldn't be too hard since some of you came quite close to the solution. Think not of a literal addition, but of a more... hmmm.. intellectual one? Don't worry, I will still talk to you even if you fail to solve this problem. But, there will be consequences down the line. 355 + 292
The libraries linked suggested that the numbers actually referred to the Dewey Decimal System. Thus, the message was decoded as:
Classical religion + military science
A Discord user realized that the code was referring to Mars, the Roman god of war. This led to a discovery of a whole new directory at /mars/.
A Critical Decision
- The Mars directory was discovered to contain a list of cryptic files:
BRIEFING23358.pdf Brett1.txt Brett2.txt Brett3.txt Brett4.txt Director1.txt Director2.txt Director3.txt Director4.txt
- The content of the Brett messages can be found below.
Hi there, I'm Brett. I don't know if Laeticia told you about me, but I work for her group, the Friends of De Molay. Teragon didn't catch me when they raided our place. It took me a while but I finally managed to infiltrate their headquarters. I'm heading down to the holding cells now. TTYL Brett
I just got rid of a couple of guards. Well, when I say "get rid," I mean I used a stun gun. I'm not exactly.. errr.. a hero or anything. I'm about to reach the holding cells. Brett
Dammit, I think someone spotted me. I'll have to be quick about this. Brett DAMN! There's an electronic keypad.... Hey, you don't have the code by any chance? Brett https://strawpoll.me/6727907 PS: You have one hour. Your choice is final.
- The content of the Director messages can be found below.
Dear recruits, I know everything. I know you've been helping that mad woman, that Laeticia... Don't worry, by the way, she's perfectly safe in our holding cells at the moment, along with the other members of her group. What I can't understand, however, is why you chose to betray us. We placed our trust in you and you thanked us by working for our sworn enemy. X
I am not ready to give up on you yet, though. X
You need to help us. X
Will you be faithful to us? We know there's an intruder somewhere in our building. Where is he? X
https://strawpoll.me/6727907 PS: You have one hour. Your choice is final.
- Brett4.txt and Director4.txt were found to contain a strawpoll offering us a decision to either help Teragon or help the Friends of De Molay.
Betrayal!
- At the conclusion of 1 hour, the option to help Brett won out, and the files in the Mars Directory were replaced with a message from Laeticia:
We made it out of the Teragon headquarters! We are now en route to a new secret location where, hopefully, we'll be able to finally plot our next moves and prepare to take down Teragon for good. And this is all thanks to you, my child. Over the past few days, you have been... ...so smart when you helped us decipher Teragon's codes... ...so brave when you chose to betray the people who had recruited you... ...so resourceful when you supplied us with all the information we need to take down Teragon... ...so stupid for trusting us. Goodbye. L
- Additionally, a new pdf from Teragon's history was added to Mars, detailing why the betrayal of the Templar was necessary.
- A new picture was also added to the directory, hinting at the next actions of the Friends of De Molay. The arrows point to capitals of the following countries.
Norway, Portugal, Greece, South Korea, Botswana Oslo, Lisbon, Athens, Seoul, Gaborone
- By taking the first letter of every country and rearranging them, the Discord Chat arrived at the decoded text
goals
A Bright Hope
- A goals.txt was found on the Teragon website
Why? Why did you choose to betray us? Why did you help them? We gave you a job. We trusted you. We are in dire need of people to help us. The future of the world is at stake. We may never be able to fully trust you again, but at least you can help us. We need help deciphering a message from L's group: A famous person, but not famous people 1.51,1.63,1.64,2.40
- Discord chat user DR orcsid realized that this was the exact same puzzle used in the endgame ARG. The number correspond to the brightness of the stars
1.51 - Adara 1.63 - Gacrux 1.64 - Bellatrix 2.40 - Aludra
- The names of the stars all point to the French heroine and Maid of Orleans, Joan of Arc.
- Using the previous clue, joanofarc.txt was found on the Teragon website with the following text.
Hmm. Thank you. To be fair, our analysts actually did find out the answer before you did. By using Google. But, thanks for the help anyway. So, we have another task for you. We may have found the website Laeticia uses to communicate with her people. https://happycats.club/ Hidden somewhere on that site should be the proof that this website belongs to her people.
- PerniciousOctopus confirmed the link that the website was owned by Laeticia using a whois page.
- Suspecting Laeticia to reuse the same txt names as she had before on the Teragon website, a Discord chat user found donotdespair.txt on the Happy Cats website, which read
To Brett: Please don't forget the cake. I'm hungry. To Marjorie: We need to decipher this ASAP. It was sent by X Thanks KBJMUBCTOIYX Marjorie, we made some progress on the code. Apparently, it was encoded with something called a "Beaufort" cypher. Hope that helps!
- This is A Beaufort cipher.
- Discord user FaceNC successfully decoded the cipher, resulting in the following text.
THISISMYPATH
The War Rages On
- Using the previous clue thisismypath.txt was found on the Teragon website.
.... ... .... ..... .... .. ..... . . ..... .. .... ... . ... . . . ... ... . ... . ..... .. .... .... ... . ... . ..... ..... ....
- Discord User Kaglicious quickly determined this to be a tap code, and solved it to obtain the following clue.
surveillanceiskey
- A new surveillanceiskey.txt was discovered on the Teragon website, with the following text.
Thank you for telling us about this security breach. The information in L's possession is now worthless. We intercepted a new message from the Friends of De Molay. " whdalvyjcugenblqy This is your passcode. The key to decode it is a word that starts and finishes with five hundred, has a one, a letter and a five in the middle. "
- Discord chat realized that the key was the Roman numeral DAVID, starting and finishing with D = 500, and with A, V = 5, and I = 1 in the middle.
- Discord User Nyu identified the cipher as a vignere cipher, and solved the cipher using the code DAVID, leading to the next clue.
thisisyourdestiny
- thisisyourdestiny.txt was found on the Teragon website with the following text.
Guilty. All guilty. And, that snow... Oh, all the snow... But the little man with the egg-shaped head was not fooled, even from the very first words of the story. 10/2,4/1,23/2,2/2,7/6,3/4,2/2,4/3,1/1,3/3,3/4
- Based on the "egg-shaped" head referring to Hercule Poirot, and "the very first words of the story", Discord user Blitzhy realized it was a book cipher based on Agatha Christie's Murder on the Orient Express. Each pair of numbers represented a word and letter number, respectively. For example, 10/2 represented the second letter (y) of the 10th word (Syria).
- The book cipher was solved to produce the following phrase.
youarealive
- youarealive.txt was found on the Teragon website with the following text
The guide is my keyword. CCJXV ZGZAB YKAXV CTQEK PXIGO XWLTB TCKAE DIDZP BLGKZ I betrayed my friend. I waste my money. I often get angry. I can see your future in the palm of your hand. I love sex. I burned a house. I believe in doctrines that contradict the Bible. I am not baptized. I eat too much.
- The nine phrases correspond to the nine circles of hell in Dante's inferno, which when reordered correctly, read this
Limbo - I am not baptized. Lust - I love sex. Gluttony - I eat too much. Greed - I waste my money. Anger - I often get angry. Heresy - I believe in doctrines that contradict the Bible. Violence - I burned a house. Fraud - I can see your future in the palm of your hand. Treachery - I betrayed my friend.
- Reordering the nine lines of ciphertext in the same way results in the following cipher.
7DIDZP PXIGO BLGKZ ZGZAB YKAXV TCKAE XWLTB CTQEK CCJXV
- Discord chat user Scoranio identified the code as a Vignere cipher, then deciphered it using the key Virgil, the name of Dante's guide, obtaining the following sentence.
iamthecapitalcityofthesmallestcountryineurope
- This sentence was interpreted as Vatican City, the site of the Holy See
- A new image was found called vaticancity.png. This was quickly determined to be a phrase written in Cirth, a dwarven runic alphabet from Lord of the Rings. Discord User -kyoto transcribed it into English text.
wherewillthemeetingbeheld
- Based on the powerpoint MEETING PREPARATION.pptx, the solution to this puzzle was determined to be the Palais du Luxembourg in Paris
- The text file palaisduluxembourg.txt was found on the Teragon website with the name of a WAV sound file.
palais.wav
- A WAV sound file, palais.wav was found on the Teragon website, containing with the sound of a ten-digit number dialed on a telephone. The number has been transcribed below.
968-273-3278
- Discord chat user iHaruku used the letters associated with those numbers on a telephone dialpad to arrive at the following text.
you-are-fast
- youarefast.txt was found on the Teragon website with the following text
How well do you know the glorious history of the Templars? 1. He was the patron of the small group that founded the Order 2. Some of us fled there after hell broke loose. ACTL 4095564047047565479466764776928449837750549562
- According to History of the Knights Templar, Saint Bernard of Clarivaux provided the original nine Templar with patronage and assistance. He was later canonized as the patron saint of the Templar Order.
- According to History of the Knights Templar, the French king Phillip IV pressured all the kingdoms of Europe into persecuting the Templars, except for Portugal and Scotland. As a result, many Templars who were able fled Europe to Scotland.
February 5th, 2016 - The Plot Thickens
The Feline Fury
- Sometime overnight, youarefast.txt was updated to read
How well do you know the glorious history of the Templars? 1. He was the patron of the small group that founded the Order 2. Some of us fled there after hell broke loose. This was the only land that chose not to persecute us. Al Co from To Le 4095564047047565479466764776928449837750549562
- Discord Users Antimony and Kolkoo realized that "Al co from To Le" were referred to a keyword route in a nihilist cipher. Using this information, as well as keys the "Bernard de Clairvaux" and "Scotland", Discord User sapwbd was able to obtain the following plaintext.
thisshouldlastalongtime
- thisshouldlastalongtime.txt was found on the Teragon website with the following text.
We need your help on another project. Apparently, Laeticia's group have come up with a new way to communicate with some of their remote followers. Go to her site (You remember the address, right?) and find out how she communicates with her people. Once you find the method and code, contact one of our operatives. Good Luck. JM
- A cryptic new post also appeared on happycats.club, featuring an image of a cat in what appears to be Jerusalem.
- The website was later updated with two more pictures of cats. These likely also contribute to the puzzle.
- A while later, the website was again updated with two more pictures of cat.
- thisshouldlastalongtime.txt was updated on the Teragon website with the following text.
We need your help on another project. Apparently, Laeticia's group have come up with a new way to communicate with some of their remote followers. Go to her site (You remember the address, right?) and find out how she communicates with her people. Once you find the method and code, contact one of our operatives. Good Luck. JM Update: There's something fishy about those damn pictures.
- Discord User Filiard ran steganography tools on the images to find that the last four images all contained the following text.
I hope work is something you find enjoyable. killing jackals vigorously 7:5 14:18 13:1 3:17 10:22
- By taking the first letters of "killing jackals vigorously", Discord User fence! determined it to be a reference to the King James Version Bible.
- Discord User Malqua suggested that "work" was a pun on "Job", a book in the Bible.
- Discord User Jack recognized the numbers as verses from the [Book of Job](https://en.wikipedia.org/wiki/Book_of_Job), and obtained the following text.
> malta
- Discord User fence! sent the following message to Teragon operative /u/Tonywan
Hey have you scheduled your time off for your Malta trip?
- Teragon operative /u/Tonywan replied with the following response.
Amazing, you actually did something useful. Hold on.
- /u/Tonywan followed up on his message with the following message, which contained the next puzzle.
Since you seem to be on a roll (yes, I'm being ironic), do you mind solving this piece of paper we found in the holding cell we were holding L in?
https://imgur.com/0hswdKk
- Teragon operatives produced a cleaner version of the map
Our people created a new, cleaned-up version of the map.
https://i.imgur.com/siIhga0
- Discord User karp suggested that the path taken through the streets was to be "added" when going right and "subtracted" when going left (from the perspective of the traveler), based on the zoom bar at the top. To add, simply append the street name to the end of the current text. To subtract, remove any letters that are shared with the street name from the current text. For example, "AB" + "CD" = "ABCD". "ABCD - DE" = "ABC". This process results in the following sequence.
PILFORD - FORD = PIL PIL + CATS = PILCATS PILCATS - PICA = LTS LTS - DST = L L + PINE = LPINE LPINE - PEAR = LIN LIN + GUISEREY = LINGUISEREY LINGUISEREY - YEAR = LINGUIS
- Discord users pyrophexx and karp obtained the following plaintext using the above process.
LINGUIS
- Discord chat users identified Linguis as a translator and potential spy attending the meeting at the Palais du Luxembourg, according to an earlier Powerpoint Presentation on the main website.
- Messaging /u/Tonywan with the solution resulted in the following reply.
Thanks. Our own people found the answer five minutes ago, but, well.. thanks. Await new instructions from JM at /inquiry/
- A directory of files at teragongroup.com/inquiry/ was found.
Congratulations on your last assignments, that was a job well done. We can now assume that the Friends of De Molay (let's call them FDM for brevity's sake) will try to infiltrate that company. We're trying to collect files on all the Linguis people working at our conference, but in the meantime can you help us with something else? There's an image we intercepted yesterday, coming from FDM. I'll place it in this folder. We're guessing it's related to Sunday's event and may contain another code. Contact Tony when you're done. Thanks. JM PS: Sorry about Tony's attitude. PS2: I'm still getting angry phone calls from people over at a McDonald's in Paris. Do you know anything about that? PS3: Some of the elements in the map may be there to throw you off. That's how L's people work. PS4: I may as well share the work our analysts have done so far with you: apparently, the letters are quite meaningless. PS5: According to our analysts, this is relevant... no idea how, though ... --- ...
- The pattern of dots and dashes says SOS in Morse code, hinting that the secret to the puzzle involves Morse.
- By reading the short and tall trees as dits and dahs in Morse code, the Discord chat arrived at the following plaintext solution.
westrikeonsunday
- A Discord User sent the solution to Teragon operative /u/Tonywan and received the following reply.
Thanks. No need to hurry by the way, please continue taking your sweet, sweet time to work on these. It's not like we're doing important work, here. Wait for a new message from JM.
- The inquiry directory was updated to include more files.
Congratulations!
- The content of Congratulations2.txt in the inquiry directory included the following message from Teragon Operative JM.
Thank you for helping us with that code. We do still need your help. And this time, it is a rather time-sensitive matter, so please do try to stick to the task at hand this time. We have one hour before we issue security clearances for the translators contracted by Linguis. Based on what you found, we can safely assume that one of them is working for FDM. Unfortunately, at this point, we have no idea which one it is. In the folder that contains this message, you will find a file listing those individuals along with whatever we have been able to find about them. We do have a lead, however. Someone found a code that may lead you to the identity of the fake translator. When you have his or her name, vote for that person's name on strawpoll. The translator with the highest number of votes will be shot. No, just kidding. We'll just deny his or her clearance, which will prevent them from working on Sunday. Remember, you have one hour to find out who it is. Come back here when the hour is up. JM
- LinguisContractors.xls details the results of Teragon's investigations on each of the Linguis's translators applying for a security clearance.
- The Discord Chat identified clue.png as a Pigpen cipher. The image was quickly deciphered to contain the following message.
the file of the agent that infiltrated linguis is in the mole directory the clue to her or his identity is hidden in the narrative
- The mole directory was discovered on the happycats.club/ website, containing the following single file.
Yesterday.pdf
- Yesterday.pdf pointed to a cryptic document of a meeting with a psychiatrist.
- Congratulations2.txt in the inquiry director was updated by JM, containing this strawpoll
Thank you for helping us with that code. We do still need your help. And this time, it is a rather time-sensitive matter, so please do try to stick to the task at hand this time. We have one hour before we issue security clearances for the translators contracted by Linguis. Based on what you found, we can safely assume that one of them is working for FDM. Unfortunately, at this point, we have no idea which one it is. In the folder that contains this message, you will find a file listing those individuals along with whatever we have been able to find about them. We do have a lead, however. Someone found a code that may lead you to the identity of the fake translator. When you have his or her name, vote for that person's name at https://strawpoll.me/6738018. The translator with the highest number of votes will be shot. No, just kidding. We'll just deny his or her clearance, which will prevent them from working on Sunday. Remember, you have one hour to find out who it is. Come back here when the hour is up. JM
- A Discord User noticed the unusual usage of animals in Yesterday.pdf pulled them out of the story.
Turkey Rat Aardvark Cat Tortoise Orangutan Rabbit
- A Discord User took the first letter of each animal to obtain the clue to the fake translator.
TRACTOR
- By referencing "tractor" with LinguisContractors.xls in inquiry, the Discord chat believed the fake translator to be Sofia Rosti, described as someone who
Loves the countryside and gardening. Dislikes reality TV and travelling.
- Other Discord chat members believed the fake translator to be Muriel Chaffart, noting that the narrator of Yesterday.pdf was Parisian, ran away from violence, and had no driver's license, consistent with Muriel's following description. Additionally, Muir-Hill names a tractor company, consistent with the "TRACTOR" clue above.
Loves Japanese culture and tennis. Dislikes driving and violence.
- Sofia Rosti received the highest number of votes in the strawpoll before the voting period closed.
- Afterward the teragon inquiry director was updated with Congratulations3.txt, containing the following message from JM.
So, you chose Sofia... Hmmm, it's an interesting choice. We just told her that she wouldn't get the clearance. She seemed pretty devastated. By the way, we've been told that FDM is soon going to send a broadcast to its remote agents. Can you monitor their website in case that broadcast is made there? If it's the case, try to decipher it and send whatever you find over to Tony. Once again, thank you for your help. JM PS: You'd better get some rest. Tomorrow is going to be an eventful day.
- Laeticia's website was updated with a cryptic new post titled "Please disregard this post" containing images of parasites and disease vectors.
- The post title was updated to read Please disregard this broadcast, likely to align better with the message from JM.
February 6th, 2016 - One Day More
Preparing for the Meeting
- Congratulations3.txt in the inquiry directory was updated with an additional hint.
So, you chose Sofia... Hmmm, it's an interesting choice. We just told her that she wouldn't get the clearance. She seemed pretty devastated. By the way, we've been told that FDM is soon going to send a broadcast to its remote agents. Can you monitor their website in case that broadcast is made there? If it's the case, try to decipher it and send whatever you find over to Tony. Once again, thank you for your help. JM PS: You'd better get some rest. Tomorrow is going to be an eventful day. PS2: Morning, sunshines. I just thought I'd let you know something that our analysts just sent me. They say: "What do parasites do?" I know, not very helpful, but analysts are always a bit weird.
- JM again updated Congratulations3.tx in the inquiry updated with an additional hint as shown here.
So, you chose Sofia... Hmmm, it's an interesting choice. We just told her that she wouldn't get the clearance. She seemed pretty devastated. By the way, we've been told that FDM is soon going to send a broadcast to its remote agents. Can you monitor their website in case that broadcast is made there? If it's the case, try to decipher it and send whatever you find over to Tony. Once again, thank you for your help. JM PS: You'd better get some rest. Tomorrow is going to be an eventful day. PS2: Morning, sunshines. I just thought I'd let you know something that our analysts just sent me. They say: "What do parasites do?" I know, not very helpful, but analysts are always a bit weird. PS3: Update from our analysts: the filenames are definitely not random. Please look into that ASAP
- Congratulations3.txt in the inquiry directory was updated as shown below.
So, you chose Sofia... Hmmm, it's an interesting choice. We just told her that she wouldn't get the clearance. She seemed pretty devastated. By the way, we've been told that FDM is soon going to send a broadcast to its remote agents. Can you monitor their website in case that broadcast is made there? If it's the case, try to decipher it and send whatever you find over to Tony. Once again, thank you for your help. JM PS: You'd better get some rest. Tomorrow is going to be an eventful day. PS2: Morning, sunshines. I just thought I'd let you know something that our analysts just sent me. They say: "What do parasites do?" I know, not very helpful, but analysts are always a bit weird. PS3: Update from our analysts: the filenames are definitely not random. Please look into that ASAP. PS4: Could the host be... us? Teragon, I mean? I'm just spitballing here, but that may be something worth looking into. PS5: GB, one of our analysts, loves haikus. He told me to give you this: A numbered letter even parasites should say a tiny sentence PS6: Unfortunately, we are on a very tight schedule today due to tomorrow's meeting. I can only give you 1 more hour to solve this. Be aware, however, that failing to solve it would have consequences down the line. PS7. Our analysts are on the same deadline. They did find something, however. It says PHELLASIOMONT. Can you make sense of it before the time's up?
- At the conclusion of one hour, Laeticia's Post was removed from her website.
- Congratulations3.txt was deleted
- The inquiry directory was updated to include a followup.txt, containing the following.
Well, it looks like you did not manage to answer the answer in time. This is rather unfortunate because we actually think that code contained a clue to the type of attack FDM plans to launch on Sunday. >Now, we're completely in the dark. To be fair though, our team of trained analysts also failed to decipher that message... So, don't feel too bad about it! Our director wants to talk directly to you. He told me he wants to explain the situation. But, before that, we have one more assignment for you. Yesterday evening, we intercepted a video message sent by FDM to some of its off-site assets. We think it might lead you to FDM's >current location. Follow the lead and, once you find the exact address, send it to Tony. We uploaded the video to our recruitment channel. JM
- Following this Teragon affiliated youtube channel Baphomet Studios uploaded a new video, Intercepted containing edited clips of Valve's Dota 2 PC game as well as The International Dota 2 Championships Tournament.
- A transcript of the narration in the video is printed here.
0:06-0:10 Underlord! Your title is worthless here! 0:35-0:46 Avoid the abysmal fortune that stews in the malicious pit. Also avoid stewed prunes and their pits 0:59-1:02 I put you under, Lord 1:14-1:27 A form of half-sentient plant often cultivated by apprentice wizard 1:32-1:34 That's a nice crater you got there 1:57-1:59 And you call yourself a lord
- The video includes bried depictions of the number +50 and +70 at 0:22 and 1:40 respectively.
- Discord User The VintageKeith reversed the audio to obtain the following message.
"A type of half sentient plant cultivated by half sentient wizards".
- Discord Users believed this to refer to a Dota 2 in-game item, the Observer Ward.
- Discord User goblingob combined "observer ward", "+50", and "+70" to discover observerward120.txt on Laeticia's website, which had the following content.
Note to operatives traveling to our temporary location on Sunday: We had to move to a new, secure location due to interference from those Teragon rats. To find our new location, you will have to make two journeys throughout the city. X marks the spot To start your first journey, follow the way of the one-dollar bill. Turn your back to Persia and turn right. Take the first turn on the right and then, the first turn on the left. Immediately turn right. Your destination is the store where two green bears stand guard. Follow the way of the same bill again. Go visit Barbara and turn your back to her. Turn right and continue until the end of the street. Turn left and, once you find a decent place to buy the latest fashion from London, turn left again. Turn right and take a rest with the good doctor in front of the Eiffel tower.
- Discord chat users interpreted the hints as street names in Paris, and found an x sign at Hotel California at the intersection of the two points of the road.
- Discord User Jack messaged the location to /u/Tonywan, and received the following response.
You actually found something valuable! Amazing! Wait a moment, I'll send one of our TAC teams over there. I'll report back in a few minutes.
- /u/Tonywan followed up his previous message with the following report.
Our TAC team got over there and entered the building in full tactical gear. Result: Two old ladies were there, one of them is now waiting to get transported to a nearby hospital for heart palpitations. Great work, Sherlock. Please try again and this time, PLEASE BE ACCURATE
- A second attempt by the Discord chat resulted in identifying the center of a cross generated by the two paths
- Discord User HerrMyth provided live geographic intelligence from the scene in Paris.
- Discord User HeroofWind sent the location to /u/Tonywan, and received the following reply.
Report from our TAC team: nothing suspicious whatsoever. The beds are fluffy, though.
- A third attempt at Discord chat was able to refine the cross to center at 27 Rue de Berri Photo credit to Agent HerrMyth
- /u/Tonywan gave the following response after being notified of the new location.
Our TAC team just sweeped the building. The second floor was empty, but we did find some FDM documents in there. There was a lukewarm cup of coffee on the table too. It looks like they left in a hurry. How did they know we were coming? Whatever. Just go back to /inquiry/ and wait for the next task.
An Inquiry
- The inquiry directory was updated to include the following files.
FromJM.txt youdeserveanexplanantion.pdf newtask.txt
- FromJM.txt contained the following message.
Guys, great job on the location job. We still don't know how they were able to elude us though. By the way, our director wants you to read something. I'll upload it here.
- newtask.txt contained the following message with a link to Laeticia's /g/ Directory
While our TAC team is still trying to find clues at the location, we have a new task for you guys, if you're up for it. There seems to be something over at https://happycats.club/g.txt Can you investigate? JM
- Discord users found goals.txt on Laeticia's website with the following text.
Gunthar goes to the good grocer's for grapes, ginger and guava
- Noting the alliteration used above, Discord users found Laeticia's /g/ directory containing the following message.
Not bad. Let's go on. I'm now thinking of a movie with Sandra Bullock and George Clooney.
- Discord users determined that the message was referring to Gravity, a 2013 film.
- Discord users found Laeticia's /g/r/a/v/i/t/y/ directory with the following text.
Wait... Sorry, I actually wanted the verb.
- Discord users found Laeticia's /g/r/a/v/i/t/a/t/e/ directory with the following text.
I'm definitely in the mood for a gerund.
- Discord users found Laeticia's /g/r/a/v/i/t/a/t/i/n/g/ directory with the following text.
Go back 7 places and make me hungry.
- Discord users found Laeticia's /g/r/a/v/y/ directory with the following text.
I changed my mind. Let's start from scratch. @
- Discord users found Laeticia's /a/t/ directory with the following text.
Append a small, sharp, broad-headed nail.
- Discord users found Laeticia's /a/t/t/a/c/k/ directory with the following text.
Go to the exact opposite and you will find what you seek.
- Discord users found Laeticia's /d/e/f/e/n/d/ directory with the following text.
Note from our mole in the recruits' Discord channel: Please leave location immediately. TAC team is on its way.
- /u/Tonywan delivered the following message.
Well, that's pure irony, isn't it? Wait for new info in /inquiry/
Another New Inquiry begins
- The inquiry directory was updated to include the following files.
youdeserveanexplanantion.pdf youdeserveanexplanantion2.pdf news.txt
- news.txt contains the following message
So, there's a mole among you? That's... troubling to say the least. Give us a moment to figure out what to do with this. In the meantime, the director wants you to read something else.
- The inquiry directory was updated with the next clue, Capture.PNG.
- Capture.PNG was determined to be a Templar Cipher. The cipher decodes to the following plaintext.
miann
- Discord user NinaM(an anagram of "miann") revealed herself to be a member of FDM. A transcript of the chat log follows.
NinaM - Today at 1:53 PM We're all your friends here. We have cake. NinaM - Today at 1:54 PM You chose us before. You can choose us again. Tony called you way worst things. NinaM - Today at 1:55 PM We didn't betray you. We are doing what we have to do. Make up your mind. You have one hour. https://strawpoll.me/6744112
- At the end of the alotted period, the option "Stay with Teragon" won the poll 216 to 189, amid heavy suspicions of voter fraud.
- The inquiry directory was updated to include the following files.
youdeserveanexplanantion.pdf youdeserveanexplanantion2.pdf youdeserveanexplanantion3.pdf work.txt
- work.tx contained the following message.
Thank you for taking care of that mole. We're working on something at the moment. You might be able to help us with something though. We received intel telling us that FDM may be looking to get their hands on chemicals urgently. They may even be looking for sellers on the Internet. Can you check whether there's any proof to that? Thanks. JM
- work.txt was updated with the following message.
Thank you for taking care of that mole. We're working on something at the moment. You might be able to help us with something though. We received intel telling us that FDM may be looking to get their hands on chemicals urgently. They may even be looking for sellers on the Internet. Can you check whether there's any proof to that? Thanks. JM PS1: United we fall, divided we stand. PS2: Think about the places people on the Internet go to when they want to buy stuff from private individuals. I doubt they would buy that stuff from a company, that leaves a paper trail.
- Discord user pastoras discovered this Craigslist listing, referring to Methylphosphonyl Difluoride, a chemical weapon precursor. A screenshot of the listing can be seen here.
- newwork.txt was added to the inquiry directory with the following content.
Good job on the chemical. That's definitely worrying stuff. Our teams will start researching the sarin gas angle right now. Can you do something for us? Can you please monitor the damn cats site for anything new? If anything new comes up, please investigate. JM
- Laeticia's cover website was updated with a new post, THAT KITTEN THO xD, containing an image of a cat.
- Discord user fillard found a hidden image inside the cat image using steganography.
- Discord user Kaglicious identified the hidden image as a dancing man cipher from Sherlock Holmes
- Discord user DevonMC discovered that this dancing man cipher was mirrored from the original
- Discord chat was able to decipher the cipher to obtain the text
WEWILLRENTAVOLKSWAGENTOURANNEXTWEEKANDPICKYOUGUYSUPATTHEAIRPORTONSUNDAY MORNING
- Discord User Jack received this message from /u/Tonywan in response.
Where's the rest? Nevermind, it's correct. For once, you did something right. Hooray.
- The inquiry directory was updated with a new upcoming.txt with the following content.
https://happycats.club New post Get on it right now. Tony
- Laeticia's webpage was updated with a a new post titled "Something for our friends, containing an image and the following cipher.
1225424453544455522344542123543442343255345345422521532533254245555331342453444325442522253144522554444344525244122154113452542513
- Discord Users hex010 recognized the cipher as a polybius square, and solved it with the following key as seen here.
VWXYZABCDEFGHIJKLMOPQRSTU
- He obtained the following solution.
WELOSTOURCOTACTTILIGUISPLEASEHELPUSFIDSOMEOEBEFORETOMORROWATVIRTEX
- By placing the Ns and spaces appropriately in the above text, Discord chat arrived at the following message.
WE LOST OUR CONTACT IN LINGUIS PLEASE HELP US FIND SOMEONE BEFORE TOMORROW AT VIRTEX
- The inquiry directory was updated to include the new video.txt, containing the following text.
We were just sent a new video directly by FDM. Apparently, they want to communicate with us. Can you please try to decipher it for us? We will upload it shortly to our channel. JM --- PS: We will give you clues if you fail to decipher like you do. Like you failed to decipher half of the previous codes. Tony
- Teragon's Baphomet Studios Youtube Channel has been updated with the aforementioned video. The video contained the following cipher.
REVRF ATFE IIGID XVRDN RXFYN WPNLW OWLRK IYYZY KSGOD IHYDT PESMO OQXZQ ZDPGI CKTTR XXCID
- Discord User CymLine identified the location in the background as the Valere Balisica.
- Discord User dist ( /u/dist on reddit) decoded the video cipher using a Vignere cipher with the key "Valere" to obtain the following text.
weknowyouarelisteningtouswejustwantedyoutolosequiteabitoftimedecryptingthis
- The inquiry directory was updated with assignment.txt which contained the following text.
Congratulations on solving this... errr.. unusual encrypted message. We are now busy preparing for the meeting tomorrow. I suggest you have a good night's rest and come back tomorrow at 3PM CET, when the meeting will take place. Any task that takes place tomorrow will take place in real time, to allow us to prevent whatever FDM plans on doing tomorrow. JM PS: It would be a good idea to use your time wisely by studying what you've learned so far. It might come in handy tomorrow.
- Discord User Yzark-Tak managed to solve the parasite puzzle by solving the anagram "PHELLASIOMONT" with the following message.
POISONTHEMALL
- This is believed to refer to a sarin poison gas attack at the meeting in Palais du Luxembourg.
February 7th, 2016 - The Big Day
A New Ally...
- At exactly 3PM CET, we were greeted by JM with this message:
Hi guys, I'm glad you could join us today. We need all the help we can get in order to prevent FDM from disrupting these talks. For the sake of the world, these negotiations today must succeed. I'm going to pair you with one of my best people. That person will act as your liaison throughout the day. We have three senior agents on site, Renee, Mark and Tony. Unfortunately, Mark is currently busy investigating a new lead and Tony just told me that he'd rather have all of his teeth pulled with a rusty pair of pliers than having to work with you guys. So, that leaves Renee. You're in luck, she's an amazing agent. I was just informed that she will upload instructions for your first task in a very short while. Good luck. JM PS: Today is Renee's birthday. Don't forget to wish her a happy birthday, I know she'll love it!
- We then received a message from Renee:
Hi there! So, you're the guys I'm going to work with today, right? Super! I've heard great things about you! Sorry if I'm a bit slow to respond at the moment but, well, it's my birthday and some of my colleagues just brought me this extra-large piece of devil's food cake. You guys want some? I could totally send you some, I'm sure there will be plenty left over. Okay, anyway, here's how today's going to go down. We have a series of tasks to perform. Unfortunately, we're on a really tight schedule, with the talks supposed to begin soon and all that... So, we only have an hour to perform each task. I know, bummer, right? If we don't complete a task in time, well I'm afraid there might be very unpleasant consequences down the line. Also, that one-hour time period is for everything. Solving a puzzle, answering questions, whatever... For example, if you choose the wrong answer to a question, you'll have to answer it again until you give me more accurate information. All of that reduces the time available to solve whatever codes, ciphers or puzzles FDM have in store for us. Got it? Alright! I'm so thrilled to be working wi wait a mmdnt pls brrrb
- After Renee had to run off, another message from JM was recieved:
Hey guys, Sorry about that. Turns out someone had the bright idea to leave Renee's cake in a hot room for 24 hours before serving it to her. From the looks of it, she's going to be unavailable today due to a bad case of food poisoning. I'll have to pair you with someone else. Wait a moment. JM
A Rusty Pair Of Pillars
- We then recieved 3 messages from Tony, containing the following:
... Oh, hell no. I was just told that, apparently, the choice is simple: work with you or get fired. So, let's work together. Just try not to stab me in the back, like you seem to regularly do. First off, we need to inspect the parking garage. Our inspection will be over by 4PM CET, sharp. About the garage: our team found some suspicious vehicles in there. I'll upload a list of pictures. Look at them and choose the one that you think we should break into and search. https://strawpoll.me/6751370 You have 10 minutes to give your answer. Oh, and because you seem to enjoy manipulating votes (wouldn't really expect anything else from traitors, would we?), we added some captcha thing to the strawpolls. Hopefully, you're better at solving CAPTCHAS than at solving ciphers. Tony PS: Sorry about the pictures. We have a new guy here and I think he has no idea how to use a smartphone camera. I want to punch him in the face.
- The directory was updated with cars.rar (album with contents).
- Discord chat quickly figured the suspicious vehicle to be a Volkswagen Touran, the same vehicle from yesterday's stickman code.
- Discord Users, after being given the opportunity to vote (with a CAPTCHA) on the most suspicious car, voted for car8, which corresponded to the image of the Volkswagen Touran.
- The inquiry directory was updated with this image, which was identified as an Orgham cipher. It was solved to obtain.
thescrambledkeyisscalet
- "Scalet" was found to be an anagram of "castle" which referred to Valere Castle from an earlier video.
From Tony With Love
- The inquiry directory was then updated with FromTony1.txt, which contained the following video:
https://www.youtube.com/watch?v=rSzRaZzMqPQ
- The video has four messages coded inside. These codes were used to rule out other suspects and select #4 from a .rar folder of pictures uploaded to the inquiry directory, the images of which you can viewed here
- The inquiry directory was then updated with FromTony2.txt, which contained the following message:
Go to work 31 16 16 18 49
- Discord user Crauss found that by mapping these numbers to the Periodic Table you get:
GaS SArIn
- The inquiry directory was then updated with FromTony3.txt, which contained the following message:
;.)8;0.
- Discord user hex010 solved to TRAITOR by using substitution.
- Teragon's Baphomet Studios Youtube Channel was updated with a new video (editors note, video has since been deleted) around this time.
- In the video, the song "New Order - 60 Miles an Hour" is being played in reverse. However, at the time, nobody realized that the text displayed in the video was a cipher to another "New Order" song "Bizarre Love Triangle", as indicated by the BLT clue which followed.
- The inquiry directory was updated with FromTony2.txt, containing the following message.
Heads of state are now assembled in the meeting room. It is imperative that we find this canister ASAP or we may end up with over a hundred dead heads of state in an hour or so. I will upload a map. Clues to the location are in a video we found on the cat lady site: https://youtu.be/0wCvkH2Ymr0 Get on it. Like, right now. Tony
- The inquiry directory was updated with a floorplan of the Palais du Luxembourg.
- Teragon's Baphomet Studios Youtube Channel was updated with a new video. The video contained the following cipher.
Time for a BLT sandwich with extra mayo 5/1 3/5 3/5 1/15 4/7 1/6 1/6 6/5 1/1 19/4 2/8 4/2 3/4 4/5 1/1 1/4 4/3 4/2 1/4 3/4 4/4 2/1 12/2 2/7 1/6 12/2 2/8 3/6 4/7 2/6 1/6 1/6 2/7 1/1 19/4 4/7 1/8 2/6 1/6 3/5 1/4 5/7 5/6 1/1 1/1 3/4 1/6 1/1 1/4 1/6 2/7 1/1 1/17 2/1 1/4 2/6 1/6 1/4 3/5 3/5 1/8 3/5 3/4 10/9 3/5 6/2 1/4 2/5 1/1 2/2 1/6
- the inquiry directory was updated with a new message fromTony3.txt, reproduced below.
Faster, ladies. We just found out that FDM have just locked all of the heads of state in our meeting room. Fortunately, the director was running an errand at the time and he is currently safe with us. We're working on trying to break into the meeting room, but that seems highly unlikely what with the reinforced walls and all that. In other words, move your shiny little butt, we need to find that canister RIGHT NOW. Tony.
- After the alotted one hour, the Discord chat failed to reach a conclusive answer, resulting in fromTony.txt
*slow clap* Amazing work, guys. Good thing our teams sweeped the other floors of the building, so at least we know the bomb has to be located on this floor. Time for your last task: finding and neutralising the threat. First, since you failed miserably at deciphering the clue, we'll need to find the room. Vote here: https://strawpoll.me/6753987 You have five minutes. If you fail, I will ask the question again. So, every time you guess wrong, you basically lose 5 minutes out of the hour you have to neutralize the threat. Please try to use your brain cells this time. Tony.
Trial and many errors
- After voting incorrectly for "the storage room next to the meeting room", Tony updated the inquiry directory with FromTony2.txt.
We just broke into the storage room. We did find something: brooms, napkins and a dead mouse. No bomb, though. https://strawpoll.me/6754066
- After voting incorrectly for "the office next to the meeting room", Tony updated the inquiry directory with FromTony3.txt.
We looked inside the office room. Nada. Nothing. Zilch. Rien. https://strawpoll.me/6754123
- After voting incorrectly for "kitchen", Tony updated the inquiry directory with FromTony4.txt.
ARE YOU KIDDING ME? DO YOU SECRETLY WANT TO GET ME KILLED? THERE'S NOTHING IN THAT KITCHEN!!!! https://strawpoll.me/6754182
- After voting correctly for "lunch break area", Tony updated the inquiry directory with Defusing.txt.
FINALLY! Good job on losing over 20 minutes in there. Anyway, time to shine, ladies. We found the canister. It was brought to the Palais inside a giant cake and is now attached to the AC vent and moving it may detonate it. So, we have to defuse the dispersion mechanism before it goes off at 8PM. I see five colored wires. They're all next to each other, from the left to the right. I'm pretty sure that cutting the wrong one will cause that thing to go off, so please find which wire I need to cut AND BE RIGHT. I have attached a cipher we found behind the mechanism's casing. I guess deciphering it will give you instructions. Tony PS: Our sketch artist drew me in front of the bomb. I attached the drawing just so you can properly picture the situation. Just so you don't stupidly waste time on this, please note that that drawing has no code embedded in it.
- The inquiry directory was updated with an image of Ton.
- The inquiry directory was updated with cipher.txt
- The inquiry director was updated with Defusing2.tx, reproduced below.
FOCUS, DAMMIT! Our guys just found out that the first step might be an Atbash cipher. Please look into that. PS: Don't message me, I don't have time to check Reddit. I will run a Strawpoll at the end.
- Discord user Trialtrex21 deciphered cipher.txt using Atbash, resulting in the following text, identified to be French song, Ave Maria.
- Discord Users DevonWC, Pan Heath and W4nn4be used the Ave Maria cipher to obtain following English text.
THE VERY LONG CABLE IS GREEN THE MEDIUM CABLE HAS FOUR STRANDS THE LONG CABLE HAS CAT WRITTEN ON IT THE ORANGE CABLE IS LEFT TO THE RED CABLE THE ORANGE CABLE HAS PANTHER WRITTEN ON IT THE CABLE CONNECTED TO A METAL PLATE HAS THREE STRANDS THE BLUE CABLE IS CONNECTED TO A SCREW THE CENTER CABLE HAS LION WRITTEN ON IT THE SHORT CABLE IS THE FIRST CABLE THE CABLE CONNECTED TO A TRANSISTOR IS NEXT TO THE CABLE WITH FIVE STRANDS THE CABLE WITH A SINGLE STRAND IS NEXT TO THE CABLE CONNECTED TO A SCREW THE CABLE CONNECTED TO A CIRCUIT BOARD HAS MONKEY WRITTEN ON IT THE VERY SHORT CABLE IS CONNECTED TO AN LCD SCREEN THE SHORT CABLE IS NEXT TO THE WHITE CABLE THE CABLE CONNECTED TO A TRANSISTOR IS NEXT TO A CABLE WITH DOG WRITTEN ON IT THE CABLE TO CUT IS THE ONE WITH TWO STRANDS
- The inquiry directory was updated with the Defusing.txt, reproduced below.
Vote here before 8PM. https://strawpoll.me/6754367 I will cut the cable with the most votes at 8PM Our director has now been evacuated to a safe location. He will leave his final report in the /inquiry/ directory at 8:15PM at the latest to tell you what happened.
The Conclusion
- At the conclusion of the poll, the Discord chat decided incorrectly to cut the red wire.
- The correct solution can be viewed here
- The inquiry directory was updated with FromTheDirector.txt reproduced here.
Ladies and gentlemen, Unfortunately, as you probably have heard by now, the bomb went off and decimated all of the heads of state on site. There is, however, a silver lining: our team did manage to get out before the gas spread outside of the meeting room. Whatever happened, Teragon will help the world as it grieves for its leaders. It might take us longer, but I swear that we will not fighting until FDM's plans are thwarted. On behalf of everyone here at Teragon, I want to sincerely thank you for your help. You did miss a few things here and there, but overall, you did a good job. However, you have to understand my position. I cannot offer you a position after you leaked some of our confidential data to FDM. You will, however, always be remembered for the help you provided us during this ordeal. With our deepest gratitude, Director, Teragon Group
- The inquiry directory was updated with FromTheDev.txt reproduced here.
Hi people, My name is Nicolas. Some of you may also know me as /u/gayfarang from /r/dota2. First off, I would really like to thank you for participating in this ARG. I've been wanting to do a "da Vinci Code-esque ARG" for quite some time now and I only recently came up with a reasonably solid scenario. It's been a lot of fun on my end and hopefully, it's been fun for you as well. When I started conceptualizing this ARG, I wanted to do something a bit different -- an ARG where at certain points participants could choose their own path. I also wanted those choices to have a real impact on the story itself, which led to a few issues, namely the fact that it was impossible to create most of the content before starting the ARG itself since I didn't know which path you guys were going to take. This being said, I am still impressed with how this ARG all went down. In a week, we got: - Up to 600 people at a time in the Discord channel - 90,000 views on the YouTube videos - Hundreds of thousands of page views on the two websites used in this ARG. This is wayyyyy better than what I had expected at the beginning, so, once again, thanks a lot to you trait...err.. guys! I definitely plan on doing another, completely different ARG in the future. /u/gayfarang @GayFarang_DOTA on Twitter PS: If you guys have questions about some of the stuff, I can do a small unofficial AMA on /r/gamedetectives
- The post can be viewed here. Gayfarang answered many questions about the how the ARG was made including his inspiration, the decisions taken during the ARG and the characters which we grew to love and hate. In the end though, we solved mostly everything, so a pat on the back to everyone who helped and the editors who kept this timeline updated.
