The story begins
This page is still incomplete in regards to the full ARG. Missing information will be added at a later date, and the formatting will be updated to match that of the Unidentified Signal ARG with more accurate Times and dates.
October 23rd
A number of cryptic questions have been sent out to a couple of Warframe partners:
Partner
Tweet Content
Time
DKDiamantes
16:25 UTC
esp4him
16:29 UTC
Frozenbawz
16:33 UTC
Danielthedemon
17:00 UTC
Wgrates
17:11 UTC
Quite Shallow
17:12 UTC
Mogamu
17:15 UTC
iFlynn
17:16 UTC
Shanksy1387
17:30 UTC
Brozime
17:54 UTC
Whenever a partner answered correctly the PlayWarframe Twitter account would respond with "Code accepted. Agent confirmed. Check your messages."
According to Quiet Shy, the message they received was a Discord invite to the server Solaris United. The Discord is modeled to look like a transmission protocol that is transmitting messages to the members of the server over Corpus frequencies.
The Business
A prominent figure called "The Business" is the individual sending messages on the Discord server, where all of his messages are prepended as well as appended by messages by a Discord user called "Server Messages", where the messages state the beginning or the end of a transmission from The Business.
The first task
How do you do, Outworlders? They call me ‘The Business.’ I need your help. I've scuffled with my share of scoundrels, but Nef Anyo and the Corpus — or ‘the Taxmen,’ as they’re known around here in Fortuna — are the worst of ‘em. There was a time we openly fought back against the Taxmen, until things went south after the incident. We’ve lived in the shadows ever since. Outworlders, we must rebuild Solaris United. We must, once more, fight for our freedom. Will you help us?
Some of us still act on behalf of the old Solaris United, what little of it remains. We have agents tracking Corpus shipments on the Vallis: resources we can steal to help our people make payments and clear debts. Help me recruit members for Solaris United, and I’ll add your cut of the bounty to a Cache. I’ve created a #cache channel to track your share. Tell your fellow Outworlders we aren’t giving up without a fight. We are Solaris, and down here, we all lift together. I’ll contact you again soon. Stay sharp.
All users present in the server at the time of this first message being sent have been tasked with recruiting more people into the server.
People were also offered a share of the bounty through a secondary channel called #cache.
A second transmission followed thereafter, notifying people of a new channel called #intel where The Business would provide additional information:
Outworlders, you've done well in recruiting new members for the cause. Because of your efforts, I'm opening a new channel, #intel. I will deliver additional information to you there. Stay sharp.
Intel
The first message in the #intel channel contained a welcome message, shortly followed by new information regarding the repossession of cybernetic upgrades belonging to residents of Fortuna:
Repossession. Nasty business. The Solaris need cybernetic upgrades to protect themselves from the hostile Vallis climate. And guess who supplies the upgrades? Nef Anyo and the bloody Taxmen. We’re forced to do the work, and then we pay the Taxmen for the ‘pleasure’ of hard labor. Because of these mandatory body mods, we all live in debt to our Corpus overlords. It’s a vicious cycle we cannot escape through obedience.In Fortuna, we live in fear of ‘repossession.’ At any hour of the day, Nef can send one of his vile repo squads down here to ‘take back what’s theirs.’ Limb by limb, piece by piece, the Taxmen will rip out your cybernetics until there's nothing left of you. We must fight back, Outworlders. Because if we lose, we lose everything.
An image was attached depicting a report over what happened with one of Solaris United's agents (HR-67)
After translating the contents of the image from the Corpus alphabet, the following was provided (Created by Vuthakral#9761 on the ARGrakata Discord)
Encrypted Intelligence
Soon after translating the last image, as well as getting over 50,000 members to the SU server, another message was posted by The Business:
Great work over the weekend, Outworlders. You’ve helped us reach 50,000 members.I have new intel for you. Unfortunately, the Corpus have encrypted the file. Outworlders, work together to help me break the encryption. Share the final message with me using #LiftTogether.
A .wav file was bundled together with this message, containing an encrypted message. After further investigation, people came to the conclusion that a sequence of DTMF tones were present in the recording, hidden behind rather strong static. The tones were translated into a series of numbers with th confirmation of the tones with a spectograph: 24859 782887 7435833 Which then could be translated using letters associated with these numbers on a phone keypad. The following was unveiled: BITLY STATUS SHELVED which could be then made into a link including a new image, similar to the last one (http://bit.ly/statusshelved)
Image after translation (Once again, thanks to Vuthakral#9761):
After learning about HSE-85's terrible fate, The Business reached out once again to the members of the SU server, thanking them for finding out what happened with this agent, and said that he would once again contact the members the next day:
Good work cracking the code... despite the bad news that it brings. Agent HC-85 is the agent we lost during the first shipment. Brain-shelved. Just as I feared. I’ll share what you found in #intel. Thankfully, Nef doesn’t suspect Solaris United was involved in stealing the shipment. That’s the one bit of good news here. Still, I’ll need to keep this off Eudico’s radar. Rumors spread fast here. We lost a good one, Outworlders. Thank you for the closure. Take a moment today to honor him. I’ll talk to you tomorrow.
V Prime
After learning about HSE-85's terrible fate, The Business reached out once again to the members of the SU server asking for help. Another agent was returning with a new shipment to Orb Vallis, and needed a distraction to make sure that the shipment as well as the accompanying agent would return unscathed. Members were tasked with targeting V Prime, Venus with a coordinated attack:
Outworlders, I need your help. We have an agent returning to Orb Vallis. She’s bringing a shipment of stolen Catalysts and Reactors, but security here in the Vallis is tight since the Taxmen caught one of our agents. I need you to create a distraction long enough so she can fly in undetected. Your Mission: Work together to coordinate an assault on V Prime, Venus. Cause as much mayhem as you can. If we take down enough Corpus in one area, we can shift their focus away from the Vallis so she can return here. Keep it going for as long as you can. Complete this Mission, and everyone here will get a cut of the shipment. Your share will be added to the #cache. Good luck, and stay sharp.
3 hours later, The Business sent out a message once again, notifying that the assault is going good, but that more help will be needed:
First reports are in. More than 7,000,000 Taxmen have been eliminated on V Prime so far. The assault is off to a good start, but we need more help. Let’s make this a day the Corpus will never forget.
After another hour, another message was sent out, this time with an accompanying .txt file that contained a base64 blob that could be encoded into an image:
Outworlders, as you’re distracting the Taxmen on V Prime, we’re taking this opportunity to steal new intel. We found this text in a Corpus database. Work together to help us decipher it. I’ll keep an eye on #LiftTogether for what you find.
Players quickly realised that the small images could be interpreted as binary, where the daylight images acted as 1 and the nighttime images as 0. The binary was then translated into an imgur link. It contained another Corpus repo report (Translation by Quint👻#0001):
The Server Update
The day after the V Prime attack, The Business sent out a message notifying the SU members that a new update to the server was coming that would upgrade the open comms on the server. After a successful update, the open comms were flooded by SU members, and unauthorized users were detected. Transmission ended abruptly, and an errorlog as well as a PDF were provided by the server. No more transmissions have come through since then.
The error log
The error log was shown to contain a number of roman numerals when word-wrapping the error log in a text editor. The following numerals could be extracted:
I (1) XXII,XXIII,XXIV (22, 23, 24) LXV (65) LXXXIV,LXXXV (84,85) CIII (103) CXLII, CCXLIII (142, 143) CXLVI (146)
The numerals were apparently incomplete, as during Prime Time during the same day, another sequence of numbers was shown, which was the numbers translated from the numerals, but with a 1 prepended as well as 161 appended to the sequence:
11, 22, 23, 24, 65, 84, 85, 103, 142, 143, 146 ,161
The PDF
The accompanying PDF was protected by a password, that was decoded from a series of tweets by the @PlayWarframe account using steganography:
feｅｌｔｈeｗeightｏfｗhaｔｗｅoｗeｆeeltｈeweigｈtοfｗhatweоｗｅfｅelｔhewｅⅰghtofwhatweowefeeltheweightofwhatweowefeeltheweightofwhatweowefeeltheweightofwhatweowe
Through decrypting, the phrase "openthehorn" could be extracted, which turned out to be the password to the encrypted pdf. After opening the pdf, a full page could be seen containing what would seem to be placeholder text. A hidden paragraph could be found in the PDF when extracting all text into another file:
The right group of Outworlders creates a tribe, one that is full of ambition and zeal. Take to the snow, show them who we are. Assemble and bring back the flare. First and only first. Head these words.
Through the use of the number sequence extracted from the numerals as well as the Prime Time image, coupling the numbers with (word, letter) as in this image:
The string "tightbeambiz" was extracted, and could be made into a link: http://tightbeam.biz
The Hack
Going to http://tightbeam.biz would show a hidden minigame on the warframe.com website, that would need as many members as possible to help out with removing the what appeared to be a jammer set up by the Corpus to deny any contact between The Business and the members of the SU server.
The hack has been completed on the 3rd of November @ 18:41 GMT. The communication between players and The Business was restored. The Business thanked everyone for the help, and said that he had agents reporting about the last shipment. A new permanent invite was added for the Discord server (https://discord.gg/lifttogether)
Urgent message
Urgent message, Outworlders...I have new intel.The final shipment is missing. Help us track down the tags so we can secure it.
The business has reached out with a urgent message. The last shipment has been lost, and a cryptic message was posted in this video on the PlayWarframe YouTube account. In the description of the video, players found an imgur link, leading to the following image:
Fortuna, California
The phrase found in the image was quickly discovered, and Agents 101 and 36 were quickly shown to be Highways 101 and 36. The point where they cross is in a town called Fortuna, California. A PDF was provided by The Business that was once again protected by a password. The password turned out to be the zipcode of Fortuna California (95540).
This second image was sent in the description of this video, sent shortly after the previous one. The object in the middle is the outline of the town of Fortuna, California.
Morse could be found in the PDF, which could be translated into a set of coordinates:
....- ----- ·-·-·- --... ..... ...-- ----. --... -- .. -. ..- ... --... ...-- ·-·-·- ----. ---.. ...-- ----- .---- ...-- --... ·-·-·- --... ....- ----- ..--- ...-- -- .. -. ..- ... .---- ..--- ..--- ·-·-·- ....- ----- ----- -.... .----
More Morse code could be found in the properties of the PDF file:
In total, 5 coordinates were found so far:
Coordinates
Ads for Fortuna are being found around some of these locations. The ads have corpus letters sprayed on to them. People are going to these location to find all of these letters and any other possible clues.
The Ventkids - The tale of Firren
Ads with corpus letters are being found around these locations. If you are one of the people going to these locations, please take clear pictures of the ads/letters/clues that you find, and post them in any of the sources provided at the top of this document.
The http://tightbeam.biz url is no longer redirecting to the hacking minigame. It is now redirecting to this video from the Warframe YouTube channel.
Images of the letters found sprayed onto the advertisements can be found in the following document:
The PlayWarframe twitter account has retweeted images of one of the advertisements, as well as responded with the following:
Ex̸̯͈̄cellent work, Outworlder. That's definitely their tag. I'll share this with the oth̵̫̊͗ers.
All six advertisements that have been found, and provided clear images of the Corpus letters have been confimed by the PlayWarframe Twitter account:
Many thanks to the champ Firren for finding two of the tags in New York.
Advertisements
Philadelphia: Tweet (Letter: T)
San Francisco: Tweet (Letter: F)
300 E 77th St, New York, USA: Tweet (Letter: P)
NYC 80th and 2nd Ave, New York, USA: Tweet (Letter: L)
4th and Market, Philadelphia, USA: Tweet (Letter: O)
Vine St and Santa Monica Blvd, Los Angeles, USA: Tweet (Letter: R)
The business has provided a new .txt file with four new coordinates to confirm. So far, one has been confirmed:
1723-1617 Michigan Avenue, Chicago, USA: Tweet (Letter: T)
Three coordinates remain to be verified:
29-22 Hoyt Ave S, Long Island City, NY, USA
Yorkville, New York, NY 10075
5 Av/w 81 St, New York, NY 10028
The PlayWarframe Twitter account has acknowledged that something is amiss, and that they will look into it. There is a quite high probability that the three ads that were supposed to be on the three coordinates above have been misplaced.
Price of freedom - The return of Firren
A new set of messages have been sent out by The Business. He has notified us of a new page on the Warframe website: https://warframe.com/fortuna/info/
Hovering over the Orb Vallis header displays the link https://www.warframe.com/fortuna/ecprifoeomrdef/ , that refers to a page that states the following:
Wake up, Tenno... It's all been building up to this... Follow the red fish.
Rearranging the "ecprifoeemrdef" part of the link will give you the phrase "priceoffreedom". Putting that phrase into a link will give you a ticker, similar to those that you could find in a stock exchange: https://warframe.com/fortuna/priceoffreedom/
Using the letter strings from the ticker will provide you with the following list of sequences:
FP ^ JUPBX MC v OQKD VP ^ MMCDV UC v LTVFN RP ^ UMCYN JE v OTURB VP ^ JGXND MD v OKYLL FP ^ MQLRS UR v PPAEO DW ^ JMRZU OH v JOYNI FP ^ JILOK UD v LMGMV RP ^ MIIOB JC v OMVEZ RP ^ UKLPX MC v LJYCR VP ^ MGZON JC v OJLMJ FP ^ MTAXC MD v OIPMZ FP ^ JXQEK UE v LLUJA VP ^ MQODK JC v OLORZ CF ^ POSEM QZK v CVFXT DF ^ PHXPL ZAI v CVUGZ EW ^ JFNZL OY v MLGSY
You can substitute the following chars with dots: "^", "v" Leave spaces as they are, and substitute the letters with the corresponding numbers, with a qwerty-based character substitution method as a reference. Note: Add a "-" to all latitude coordinates.
The qwerty substitution method:
1
2
3
4
5
6
7
8
9
0
Q
W
E
R
T
Y
U
I
O
P
A
S
D
F
G
H
J
K
L
Z
X
C
V
B
N
M
Substitute the letters with the digits that are shown above them.
Decoded coordinates
Doing that will provide you with the following coordinates:
40.77052 -73.9183 29-22 Hoyt Ave S, Long Island City, NY 40.71942 -74.00139 277 Canal St, New York, NY 40.78998 -73.97574 Upper West Side, New York, NY 40.75123 -73.98071 270 Madison Ave # 1501, New York, NY 40.72138 -73.99771 Lower Manhattan, New York, NY 40.77334 -73.95446 Yorkville, New York, NY 40.71938 -73.99941 Little Italy, New York, NY 40.75263 -73.98699 1396 Broadway, New York, NY 40.75196 -73.97977 Lefcourt Colonial Building, 295 Madison Ave, New York, NY 40.78895 -73.97431 561-577 Amsterdam Ave, New York, NY 40.78902 -73.97634 Upper West Side, New York, NY 40.77366 -73.95745 1369 3rd Ave, New York, NY 32.77417 -96.79668 Dallas, TX 32.74619 -96.79526 Dallas, TX 34.09237 -118.34425 West Hollywood, CA 34.06209 -118.34751 Los Angeles, CA
The champ, our ARG saviour Firren has once again come to the rescue and confirmed five more tags:
Confirmed locations and letters
Locations confirmed from both tag waves:
Wave 1
Tweet (Letter: L) 40°46'25.3"N 73°57'17.4"W / E 79th and 2nd Avenue, New York, USA Tweet (Letter: O) 39°57'01.3"N 75°08'49.5"W / Market Street, Philadelphia, USA Tweet (Letter: T) 41°51'32.4"N 87°37'26.4"W / Michigan Avenue, Chicago, USA Tweet (Letter: P) 40°50'51.9"N 73°53'44.2"W / E 78th and 3rd Avenue, New York, USA Tweet (Letter: R) 34°05'01.5"N 118°21'31.6"W / Melrose Avenue, Los Angeles, USA Tweet (Letter: F) 37°44'24.8"N 122°24'02.2"W / Oakdale Avenue, San Francisco, USA Tweet (Letter: T) 39°57'07.2"N 75°10'24.6"W / 20th and Chestnut, Philadelphia, USA
Wave 2
Tweet (Letter: F) 40°45'07.1"N 73°58'47.2"W / 41th and Madison, New York, USA Tweet (Letter: E) 40°45'04.4"N 73°58'50.6"W / 39th and Madison, New York, USA Tweet (Letter: M) 40°47'23.9"N 73°58'32.7"W / 89th and Broadway, New York, USA Tweet (Letter: M) 40°47'20.5"N 73°58'34.8"W / 87th and Broadway, New York, USA Tweet (Letter: P) 40°47'20.2"N 73°58'27.5"W / 88th and Amsterdam Avenue, New York, USA Tweet (Letter: O) 34°03'43.5"N 118°20'51.0"W / Wilshire Boulevard, Los Angeles, USA
Remaining locations
- (Letter: ?) 32°44'46.2840"N, -096°47'42.9360"W / S Akard St, Dallas, USA - (Letter: ?) 32°46'27.0120"N, -096°47'48.0480"W / Bonnie View Rd, Dallas, USA
Investigation
The Biz has sent a message stating that the "Temple of Profit" could be a possible location of the stolen shipment. We are once again waiting for another transmission. Well done Tenno! Get some rest and stand by for further tasking.
The shipment
The shipment has been found, and the promocode for it was released alongside the Fortuna update.
The meeting
Before The Business meets us, he has some new intel, though he requests that the Outworlders answer some of his questions using the #LiftTogether tag on twitter. Here are the questions, as well as the answers:
The questions
Question
Answer
What controls the flash?
TBD
What was the original server version?
TBD
Who controls the sun?
TBD
Who did we lose?
TBD
The __ wakes first.
TBD
What do we fear?
TBD
U-2278, a.k.a "Thursby"
After the responses were submitted, The Business sent another reposession report for Solaris U-2278, alias Thursby
The translation of the image provided the alias and the name of the subject. Tenno started theorizing that the name, U-2278 could be the code for the unicode character "Not less than nor greater than" (≸, code U+2278) and together with the alias "Thursby", could be paraphrase into "Not earlier, nor later than Thursday", making it look like the update would be released on that day.
The outworlder
TBD
Final Message
Last updated
Was this helpful?
