Discussion in 'Live Events' started by JantsoP, Dec 17, 2016.
What was the bit.ly password?
We didn't figure it out, acentes bruteforced it. We're through the PDF now too, got to a webpage that looks like this:
OK, since I can breathe for a second...
The PDF 'link' was encoded with a vigenere autokey that led to an .onion link to another Rhopagroup page. That page had a blue rose on it, which had the message "THREAT GONE MAINTAIN CURRENT TEST STRATEGY. REQUIRE ADDITIONAL MONITORING AT FALE AND ALL ABSA LOCATIONS." inside of it.
It seems we're looking at coordinated attacks on the Barclays Africa Group Banks and the King Shaka International Airport. Probably a massive heist.
Why are the Rhopagroup attacking Darknet users working in HVT-locations in Africa? I thought they were just involved in mystical dream brain hoodoo research?
We're working on it. I can barely keep up myself.
EDIT: Maybe it has something to do with this (major spoilers for Ahnayro):
After watching us lose an agent in the past I wasn't going to take the chance.
On the up-side, I saw no tails when we pulled out. Dispatch has a couple of pics of people who might've given us the hairy eyeball. And as I return to my home AOR I've seen no signs of anyone following.
So perhaps this time no one made us at the drop?
I've created a document for people to use to catch up on what's happened so far, if they're just going to jump in for the event tomorrow.
Guys, helping a friend with the missions realised this in the rosenberg clinic web page:
Rhopagroup © 2016 All Rights Reserved
That's under the Ahnayro ARG page. If you direct it to port 66 (http://rhopagroup.com:66/), it gives something labelled 365-2016. Nobody's found what it means yet.
356th day of 2016, which is today apparantly
EDIT:sorry i messed up...
i meant the 356th, NOT the 365th....
Wouldn't it be the 30th?
Also, countdown timers = bad. The idea gave me Sombra ARG flashbacks.
356, not 365. Look at the julian calendar.
Just so we have incase it becomes useful in the future and based on the new knowledge from today, me and a few others filled out a google map with the internet cafes marked with any Absa banks marked as well around them, plus the location of the airport. It also has other HVTs from before on a separate layer that can be turned on and off if they come up at all.
Its free to be edited if need be, I just figured a reference would be helpful. This map is based off the work of previous Durban maps so credit goes to previous agents as well.
Thanks for this, helped me even though I did/helped with some of it.
@Bruteforce123 I added some cafes to your map just now.
Because of your hard work, NITE Team 4 has been able to monitor communication channels used by Black Axe and other groups of interest in the 5 African hot spots. The following message was just intercepted. It was sent from an unknown source to high-ranking members of both Black Axe and Abahlali baseMjondolo:
Our analysts believe it is an enciphered message sent with an encoded key. We have not been able to uncover the encoding system of the key, but we have identified the cipher as a Vigenere Autokey.
All agents must work together to decrypt this message, as its contents likely relate to the upcoming attack on Dec 22 and may be crucial to our preventative efforts.
Send plaintext contents of the message to [email protected] and await further orders.
Monitor our Forums and the Div 66 Twitter for further details.
New email is now added to OP
@Bruteforce123 added some cafes, found a few near 'Absa Branch, Qualbert Centre, Shop 2'
Separate names with a comma.