Teragon

January 31st, 2016 - Beginnings

The 4chan Post

• An anonymous 4chan user posted a message to the Dota 2 General thread of /vg/ (/d2g/), which read:

what the hell? There's something very weird going on here: https://www.youtube.com/channel/UChbNByMTjZnnqJAMPkvD_vg/videos?  sort=dd&view=0&shelf_id=0

The YouTube channel contains 40+ short, cut-and-looped videos of professional Dota 2 player EternaLEnVy (aka EE) being interviewed, each featuring a one-word title as well as a title screen before the looped clip.

• Reddit user /u/GottaGoFats, seeing the youtube link while browsing /d2g/, posted a thread to /r/dota2 about it.

A Mysterious Entity

• Other Reddit users posting in the thread noticed every title screen & description of every video linked to the channel's sponser, teragongroup.com, a strange website which describes itself as "Shaping the World of Tomorrow" and promotes "Services" such as "Consulting", "Intelligence Analysis", and "Surveillance". A filename, "areyouworthy.txt", was also discovered at the very bottom of the webpage.

• By adding areyouworthy.txt to the end of the website's URL, the following text was discovered:

Alone on the river bank, Peter counted his money.
Somehow, only 12 gold coins were left.
How was it possible?
Surely, he couldn't have spent that much money.
A duck and two rabbits were the only items Peter had bought that week.
After subtracting the price of those three items from Peter's weekly pay, at least 30 gold coins should have remained in his pocket.
Now, what should Peter do? His 12 gold coins won't be enough to live on for the rest of the month.
Should he weep, should he beg or should he steal?
The day was nearly over.
Sulking, Peter decided to go home.
On the road, an old man came to him.
Incredibly, that old man had found Peter's missing money on the side of the road earlier in the day and wanted to hand it back to him!
Moving swiftly, Peter grabbed the knife hidden in his satchel and stabbed the old man in the heart.
Now, with his missing coins and the old man's savings in his pockets, Peter walks back home with a contented smile on his face.
What is Peter's favorite Dota2 hero?

The Second Message

• Another Reddit user, /u/TonyWan, pointed out that the letters at the start of each line are "APSHSAANSTSOIMN", which is an anagram of "Phantom Assassin", a Dota 2 character. Following the precedent of adding to the end of the website's URL, phantomassassin.txt was attempted, and another text was discovered, reading:

Teragon Group is currently looking for a M/F field asset:
JOB DESCRIPTION
Field assets are responsible for conducting surveillance and clandestine operations throughout the world, at the sole request of the Teragon  Group board members.
REQUIREMENTS
Applicants should: 
 - Be at least 18 years of age.
 - Be in excellent physical and mental health.
 - Not be members or descendants of members of occult societies, incl.: The Freemasonry, the Rosicrucian Order or the Society of Jesus.
 hp htww cpdslap esp hzcwo
 XI

• Yet another Reddit user, /u/Anon49, figured out how to decrypt the ROT11, which, once decrypted, reads "we will reshape the world". Another URL, wewillreshapetheworld.txt, was then discovered, reading:

On June 20th 1307, just before dawn, three men entered the private offices of the King in the Palace of Fontainebleau.
They gave Philip IV everything he needed to take down the only group of people with both the military and financial means to threaten his reign.
In exchange for the betrayal of their brothers, the three men were awarded a tenth of the considerable fortune of the soon-to-be-eradicated order.
Thus was Teragon born
ulnjwysearstspfgjnkf

February 1st, 2016 - Call and Return

A New URL

• Reddit user /u/Ayakura came across a new URL, /betrayalwasnecessary.tx], which reads:

Not a txt.

• By changing the .txt extension to .png, she discovered an image of Baphomet.

More Information

• Another Reddit user, /u/eltrov, managed to decypt wewillreshapetheworld.txt using an online decryption tool and the passphrase "This was Teragon born". Decrypted, the text reads:

betrayalwasnecessary

• Since /u/Ayakura had already found that URL, the .png that it led to was focused on.

• Reddit user /u/BIG_THECAT pointed out that the depiction of Baphomet found with the betrayalwasnecessary.png URL is known as "Dogme et Rituel de la Haute Magie" (English: Dogma and Ritual of High Magic), and it derived from two books by French occult author & ceremonial magician Eliphas Levi, namely "Dogme" and "Rituel".

• /u/eltrov ran betrayalwasnecessary.png through a steganography tool and revealed the following text hidden within:

The old order had become weak and corrupt.
It needed to be cleansed.
From one point of view, a betrayal. From another, a salvation.
joinus

A Message is Sent

• With the search for new "joinus" URL failing, participants began to speculate that the phrase might be directing them to "apply" to the Teragon Group. This led a number of participants to emails "applications" to the email listed on the bottom of the webpage, [email protected]

• Several hours later, two participants who had sent applications, /u/eltrov and /u/thatguy01001010, received identical email responses, which both read:

We are sorry to inform you that, based on the information found in our files regarding your education and professional backgrounds, we will not  be able to take your application into consideration.
Kind regards,
JM, 
Teragon Group, 
Human Resources Department
Sous son règne, la France était grande et les Français malheureux.
`******|||||||||**||***||****|****||||***||******||**||||||`

• The French within the message, in English, was translates to read:

Under his reign, France was great and the French unfortunate.

• Reddit user /u/HerrMyth pointed out that "JM" is very likely "Jacque de Molay". He also noted that the French signature is a quote from the book Le Roi de fer (English: The Iron King), which is the first in a series of books about the French monarchy known as Les Rois Maudits (English: The Accursed Kings), penned by French author Maurice Druon starting in 1955.

• The particular excerpt in question, "Sous son règne, la France était grande et les Français malheureux.", comes from the first page of the prologue of "Le Roi de fer", and refers to the state of the French kingdom under the rule of Phillipe (le Bel) IV. From Wikipedia:

Set during the reigns of the last five kings of the Capetian dynasty and the first two kings of the House of Valois, the series begins as the French King Philip the Fair, already surrounded by scandal and intrigue, brings a curse upon his family when he persecutes the Knights Templar. The succession of monarchs that follows leads France and England to the Hundred Years' War.

February 2nd - Watching the Watcher

A Wild Video Appears

• Sometime in the morning, the Baphomet Studios Youtube channel uploaded a 2:06 video titled "Pawn", but removed it only 15 minutes later. Reddit user /u/timmeh45 managed to mirror the video before it was taken down. The audio in the video consists of a man speaking in French, which Reddit user /u/ILikeGirlsWithHats outis a reading of the prologue of "Le Roi de fer".

• Later in the day, Baphomet Studios hosted a YouTube livestream which lasted for 7:45 minutes. The entire video consists of only one image, that of Edward I paying homage to King Philip IV of France. The audio in the beginning of the livestream appears to be identical to the audio in the "Pawn" video. Halfway through, the audio cuts to a slowed down speech similar to the Acre video.

More Emails

• Simultaneous to the livestream, the Teragon Group began responding to more application emails. Many people received a response which read:

We regret to inform you that, based on our assessment, you do not seem to have the skills required for the field asset position.
We will nevertheless keep your application stored in our database should you prove us wrong at a later stage.
 Kind regards,
 TN,
Recruitment Manager
 Teragon Group
"Shaping the World of Tomorrow"
New-York Headquarters: 501/504C, 30 Vesey Street, NY 10007
Email: [email protected]
BTC: 1NPa6HZfH1ywZafCoMoQJg4t22MT45byuu
Sous son règne, la France était grande et les Français malheureux.
xxxxxxoooooooooxxooxxxooxxxxoxxxxooooxxxooxxxxxxooxxoooooo

• Shortly thereafter, Baphomet Studios uploaded this video, which showed participants that the symbols didn't matter, only the pattern did, and also affirmed that the code was based on *Le Roi de fer* (LRDF).

• Simultaneously, the Teragon Group webpage updated to display the following under "Latest":

xxxxxxooooooooo
xxoo
xxxoo
xxxxo
xxxxoooo
xxxoo
xxxxxxoo
xxoooooo

• This clue directed participants to read the numbers in the video as pairs, which led to the theory that they were line and character coordinates to be applied within *Le Roi de fer*.

Activate the Cipher!

• Sometime during the chaos generated by the videos, the Teragon Group webpage was updated, displaying the following series of numbers in its footer:

69
22
32
41
44
32
62
26

• Discord Chat user Simon discovered the series of numbers could be applied as a book cipher to the prologue of "Le Roi de fer". Taking each number to be a pair of values - the first being a line number, and the second the n^th letter in a line (ie 69 = line 6, letter 9, etc.) - this image of the prologue can be used in combination with the cipher to reveal to word "continue".

Press Any Key to Continue

• Discord Chat user Lowcharity experimented with several different file extensions searching for a new URL based on "continue", eventually arriving at a new URL of an audio file, continue.mp3. This audio file consists of a text-to-speech recording of series of letters, which are:

qrfhycthhcsj
hehbdahhjvozzyenv
uxqyhhwaaecxamexywnhtykyqzjwzpareezzqrbdde
uhbsbhyqzrdlds

• Discord Chat channel users downloaded the mp3 file and looked through the metadata to find the name and artist of the file, which were "ultimate" and "power" respectively. Discord user Trialtrex21 guessed correctly that it was a keyed vignere cipher.

• By using an alphabet key of "ultimate" and a passphrase of "power," the transcribed ciphertext was decoded to the following:

likeaphoenix
ourorderwasreborn
betterandunencumberedbytheweightofreligion
followthetrail

Coming Soon...

• Through trial-and-error, users in the Discord Chat arrived at yet another URL, followthetrail.txt. When initially discovered, it displayed the text "Coming soon.". Within minutes, it was updated to read:

Extract from page 87 of the personal diary of Luc Delorme:
September 13th, 1948.
It’s been six weeks now since I’ve seen Anne and the kids. Six weeks since she stormed out of the apartment, Michel and Laeticia in tow, yelling  “You’re going crazy, Luc! And the worst part is, you don’t even see it. But I won’t stand here while you destroy this family!”
She was wrong, though. I’m not crazy. Maybe just slightly… obsessed.
All in all, it’s for the better, I suppose. Working on the files has become much easier now, with the apartment to myself.
This morning, went to my appointment with Pr. Halphen at La Sorbonne.
I told him everything.
The nine founders of the Templar Order and their mysterious connection to the newly-crowned King of Jerusalem.
The cover story concocted by those nine men and the King. “Protecting the roads of the Holy Land.” Ha! As if nine men could secure hundreds of  kilometers of roads!
Their well-documented nighttime excavations under the Temple of Solomon, followed by their meteoric rise to power.
They had found something, that much was clear. Something that gave them wealth and power beyond measure.
It all made sense. I knew that Professor Halphen was going to see it, just as I myself saw the light before.
But he laughed. That idiot, that stubborn fool laughed me right out of his office.
He will see, though. One day, he will see. And he will remember bitterly the day he laughed at my theories.
Time to get back to work. I still have to decipher that parchment.
I may have to take a break, though. My arm is starting to hurt. As I was leaving the office of Pr. Halphen, a young man bumped into me. He must   have had something sharp on him because something tore my sleeve and scratched my skin.
There was something that felt familiar about that young man. Had I seen him before?
Anyway, let’s go and put some iodine on that scratch (it’s turning a weird shade of blue!) and then get back to our documents.

• Shortly after the discovery of followthetrail.txt, Discord Chat user "uro" discovered another URL, parchment.png, by experimenting with file extensions based on a line from followthetrail.txt, "Time to get back to work. I still have to decipher that parchment."

• Parchment.png displays an image consisting of multiple sentence fragments and numbers, scattered around the image. Clockwise from the top, the text portion reads:

the amazing
beauty of the
page and date
significance of the

From left to right, the numbers of parchment.png read:

11
11
17
41
67
51
24
2