Killing Floor 2

Killing Floor 2
Completed
A set of Killing Floor 2 Puzzles - also known as "From a Friend".
Type	Official
Creator	Tripwire Interactive
Discovered	2017-04-21

Main Page > List of Investigations > Killing Floor 2

The Killing Floor 2 ARG/puzzle chain, also known as From a Friend, began on April 21, 2017. It was speculated that these puzzles would be leading towards the reveal of an in-game summer event. Tripwire regularly released updates to the puzzle, along with their weekly developer updates.

Initial Announcement

On April 21, 2017, a Steam announcement was made by Tripwire Interactive:

L krsh wklv phvvdjh pdnhv lw rxw! Kruclqh lv xs wr qr jrrg dqg wkh zruog qhhgv wr nqrz! Zlwk dqb oxfn brx'oo ghflskhu wklv dqg ilqg wkh foxhv L'oo eh ohdylqj. Brx duh wkh rqob krsh zh kdyh wr vwrs wklv ehiruh lw lv wrr odwh!
lxusglxoktj/znkyzgxz.vtm

Using ROT23 for the first part, and ROT20 for the filename at the end, this ciphertext was decoded to:

I hope this message makes it out! Horzine is up to no good and the world needs to know! With any luck you'll decipher this and find the clues I'll be leaving. You are the only hope we have to stop this before it is too late!
fromafriend/thestart.png

The decoded ciphertext led us to http://media.tripwirecdn.com/fromafriend/thestart.png, which hosted the following image:

Tripwire Atlassian Page

On May 4, 2017, a double XP and drop weekend was announced by Tripwire Interactive which also included a Cipher:

ah?mIoehseuktene osn e tg t okartih!yrCdhoo ge ne elcp

The cipher was later revealed using a columnar transposition cipher:

Is there anyone out there looking? Check the mod pages!

Clues were then discovered on Tripwire's Atlassian page, which lead us to this image. Modifying the color levels of the image reveals the puzzle piece, which appears differently depending on how it was extracted.

Security Footage

On May 5, 2017, a "Statement From Horzine" was distributed:

I have been asked to pass along the following statement from Horzine:
"We at Horzine would like to disabuse the rumors that things may have gotten worse with the ZED outbreaks or that "unethical" experiements are continuing. Horzine is dedicated to the fight against, and containment of, the threat that the ZEDs pose to us all. As a proof of good will we are releasing some security footage from a undisclosed Horzine facility."

https://media.tripwirecdn.com/032317/cam_02.mp4

During the last half of the cam_02 footage, "cam_04.webm not found" is slightly visible. Putting "cam_04.webm" into the .../fromafriend/ directory provides a new webm.

At roughly 2.5 seconds, a new puzzle piece is revealed.

keeplooking.png

On May 17, 2017, more information was uncovered on the Tripwire Atlassian homepage. Jared Creasy made another change to the website before Puzzle.png, by reuploaded a photo with a "FAF" description underneath.

Image analysis reveals no changes between the two photos, however, the data was slightly altered in the newest version. If you open the photo in a text editor, the very last line reads "... keeplooking.png"

As usual, you can find the image on the tripwirecdn website. Note that this image was added before Puzzle.png, and therefore is the true second piece to the puzzle.

Background Interference

On May 27, 2017, a new WWAUT was released by Tripwire Interactive, with the last few lines containing the next part of the puzzle:

LOUD NOISE WARNING http://media.tripwirecdn.com/052617/sample.wav

Running the audio through spectrogram software reveals a hidden message, (Cleaned version down below.)

Using the information around the newly formed picture reveals instructions on how to arrange an Enigma decipher. The result is a sentence spelled out in one word:

ANTONWOULDBEPROUD

A Closer Look

On June 3rd, 2017, Yoshiro made another post. The final line of the post was this:

Ybn avogyo wii erqenje. Vm wf eb nsh vwjrz jydcr, tzy nolpg vt.

By using the Vigenere cipher, as well as a key of ANTONWOULDBEPROUND (note the extra 'N'), it was decoded:

You missed the package. It is in the usual place, all rared up.

Visiting http://media.tripwirecdn.com/fromafriend/Package.rar downloads an encrypted archive, which can be opened with the password "antonwouldbeproud". Inside the archive are a bunch of puzzle pieces, named as miscellaneous words from the English language. Assembling the puzzle pieces, combined with the puzzle pieces found from the previous puzzles, yields the following image:

Re-arranging the puzzle pieces' names, we get the following message:

We can't wait to meat (meet) you once more, are you ready to play with us? We have been waiting to come out for such a long time, for you to return. It won't be long before the curtains rise. See you soon, The Ring Master And Friendly Zeds.

Summer Sideshow Event

On June 12, 2017, Tripwire officially unveiled the Summer Sideshow event, which prominently featured the completed poster we had just assembled. The next day, the event was playable in-game.