RainbowLeaks

RainbowLeaks
Active since 2017-11-20
A website called RainbowLeaks, linked to Rainbow Six: Siege.
Type	[[List_of_Investigations#Official|Official]]
Creator	Ubisoft
Discovered	2017-11-20

Main Page > List of Investigations > RainbowLeaks

RainbowLeaks is an ARG for Ubisoft's competitive online multiplayer shooter Rainbow Six Siege. The ARG was discovered on November 20, 2017, starting with the RainbowLeaks website. At this point, the ultimate purpose of the ARG is unclear, although it has connections to the upcoming PVE content for Rainbow Six Siege, titled "Outbreak".

File 1

The QR code discovered on Oregon

The completed QR code

On November 20, 2017, a QR code was discovered on the Oregon map. In its original form, the QR code is unscannable; in order to be scanned, the empty space in the middle had to be filled with the correct pixels. In the center of the QR code, and to the side of the QR code, the characters C4 are repeated.

Completing the QR Code

The characters C4, found on the QR code itself, form one of the coordinate locations on the QR code grid that need to be filled in. Scattered throughout the map are other small bits of paper with other coordinates listed on them. Here is the complete list: (NOTE: many still missing! If you find any, join the Discord server and tell us!)

• 

  (G, 3)

• 

  (B, 1)

These coordinates were used to fill out the empty space in the middle of the QR code. Scanning the QR code leads to the following URL:

http://q-r.to/rnb6TrC

This website displays an image, with the following text in its center:

@rX9p]7'CKr-

Unlocking File 1

Underneath the QR code was a link to rainbowleaks.org. This website contained a locked file named File #1, with the description Dead drop located in Oregon:

Using the password @rX9p]7'CKr- (which was uncovered using the QR code) prompted the user to enter their Ubisoft credentials to log into the RainbowLeaks site. Doing so led to a page with the following text:

My Fellow Facters, we have an opportunity to get ahead of a lie before it becomes another cover-up. Truth or Consequences, New Mexico is experiencing an outbreak and the Feds are a little too quick to send “help,” almost like they’ve been prepared. We’ve managed to smuggle intel out of Truth or Consequences through an ARNG associate of the Manifest Destiny Militia. They share our distrust of FEMA and I can’t do this alone. We need all hands on deck here. So whatever your sources, whatever you can provide, share it here so we can all benefit from it.

Here’s what we know so far: Truth or Consequences is suffering an outbreak of an undetermined nature. The CDC is front and center, and the National Guard is rendering assistance, but all the pieces fell in place way too easily. This has false flag written all over it, but who’s the bad guy here. So give me what you got… let’s add to this database before someone Jimmy Hoffa’s all the evidence.

There were also 5 images underneath:

• 

  First image

• 

  Second image (transcription)

• 

  Third image

• 

  Fourth image

• 

  Fifth image (transcription)

At this time, it is unclear if these images have any further significance, but they appear to relate to the upcoming Outbreak event.

File 2

On December 13, 2017, the RainbowLeaks page was updated with a second locked file. The description of this file was Dead drop located in Presidential Plane. Much like the first file, the second file required a password.

Postcards

On the map Presidential Plane, several different postcards were discovered, each holding different text:

• 

  "Murder not"

• 

  "the Gaggle"

• 

  "nor Quarrel"

• 

  "in the Company"

• 

  "of a Colony"

• 

  "or Conspiracy"

Each postcard has one capitalized word, which happens to be a collective noun for a group of birds:

• A murder of crows
• A gaggle of geese
• A quarrel of sparrows
• A company of parrots
• A colony of penguins
• A conspiracy of ravens

It was some time before the significance of the bird names were determined.

Twitter Hint

On December 16, 2017, the Rainbow 6 Siege Twitter account responded to a tweet by a Dr. Sztajnkrycer, whose name could be seen in the first file's documents. The message read as follows:

// Scrambled communication incoming //
bggylookocpkvsdzqhkkjhihhuipoforppmigpbgrligldywjbeytteljoopshqcblettersokizzbnrpxsvdtxwaboaflvltwucphrhmipa
jbixqmalnnxlsnbhxlpofpwrkkjfnmbstzdpqdfoeukcyafjggfiklpqsotpgwpgmhzuosvbyasnsujorkvpaxhvexgrbebirdsacnoxscsm
// End transmission //

The words look, for, letters, of, and birds could be clearly seen in the scrambled text above - as such, it was interpreted as another nudge towards the "birds" theory for the postcards. The reply from the official Rainbow 6 Siege twitter was simply:

Cease all communication immediately.
Remain where you are.

Unlocking File 2

On December 18, 2017, the second file on the RainbowLeaks site was finally unlocked. Taken together, the words on the postcards read as follows:

Murder not the Gaggle nor Quarrel in the Company of a Colony or Conspiracy

By replacing the collective nouns with their respective birds, this turned into the following phrase:

Crow not the Goose nor Sparrow in the Parrot of a Penguin or Raven

Taking the first letter of each word in that phrase led to CntGnSitPoaPoR, which was the password for the second file. When unlocked, the file contained the following text:

The President’s plane got attacked! It’s been grounded! Tell me this isn’t coincidence? Was the President trying to shut it down? Was he too close to the lies? Is this Phase II of the Truth or Consequences operation? I’ll tell you something the timing is terrible. It may have cost us a Facter within the inner circle who was helping us. He fired off some intel before the plane went dark, but what did he leave behind? We’ll never know but we’ll have to move carefully. They’re playing for keeps so that means the stakes are high. Keep that data coming, don’t let them derail the train! I’ll have more for you after we talk to some of our friends in the Russian hacking community.

There were also 5 images underneath:

• 

  First image

• 

  Second image

• 

  Third image

• 

  Fourth image

• 

  Fifth image

File 3

The community is currently waiting for File 3 to appear on the RainbowLeaks site.

This wiki page is under construction! It will be updated with new developments.