(Please note that some of the things mentioned in this post may have been deactivated by 3301.)
On January 4th, 2012, a mysterious post on the infamous website "4chan" caught the attention of many.
[ Register or Signin to view external links. ]
Some speculation surrounded the image, some say it was just a roll play, some say it is a recruitment for some of the world's top spy programs. But heres what we do know.
After decoding the image, it leads you to a link which is a "decoy"
[ Register or Signin to view external links. ]
However, if you open the image in a program called "Outguess" - a program which changes and image into text - you find this message:

"Here is a book code. To find the book, and more information, go to [ Register or Signin to view external links. ]

1:20, 2:3, 3:5, 4:20, 5:5, 6:53, 7:1, 8:8, 9:2, 10:4, 11:8, 12:4, 13:13, 14:4, 15:8, 16:4, 17:5, 18:14, 19:7, 20:31, 21:12, 22:36, 23:2, 24:3, 25:5, 26:65, 27:5, 28:1, 29:2, 30:18, 31:32, 32:10, 33:3, 34:25, 35:10, 36:7, 37:20, 38:10, 39:32, 40:4, 41:40, 42:11, 43:9, 44:13, 45:6, 46:3, 47:5, 48:43, 49:17, 50:13, 51:4, 52:2, 53:18, 54:4, 55:6, 56:4, 57:24, 58:64, 59:5, 60:37, 61:60, 62:12, 63:6, 64:8, 65:5, 66:18, 67:45, 68:10, 69:2, 70:17, 71:9, 72:20, 73:2, 74:34, 75:13, 76:21

Good luck."

The subreddit contained lots of different text posts and two images, Welcome and Problems.

Each when opened in Outguess, provide a message.

Each one contained an OutGuess message. Welcome's was this:


and Problems' was this:




This was the 'key' that Problems mentioned, being the code to the shift cipher to be applied to the lines of text in the subreddit. If this is confusing, it basically means that each letter in each string was meant to be shifted by the number corresponding to it's location in the text.

Applying the book code to the text with the full stops removed gave the following string of text:



This, obviously is a telephone number. So whenever called (However it has been deactivated obviously) it will say this:


The original image had the dimensions of 509 and 503, both of which are prime numbers. These were multiplied with 3301 to equal 845145127, which gave us [ Register or Signin to view external links. ] .

Going to this website led to an image of a cicada and a countdown. When Outguess is used, the following code is produced.



And so those who had got that far had waited, and waited, and waited, and waited. When the time came, the reapplied outguess to the image of the cicada and got this. This is where it gets creepy.



These are coordinates across the globe. At each of these locations, brave solvers found a sheet of paper stuck to a telegraph pole, with a QR code and an image of a cicada. This meant that whoever put this together is a global organization.
[ Register or Signin to view external links. ]

Upon scanning these QR codes 2 different messages were revealed. These are:


and



They also included a warning about too much collaboration, saying that only the first few, or the active few, that make it to the end will recieve entry.

The second code was found to have led to the poem Agrippa by typing in keywords from the description. This poem, found here, spat out the following after the book code was applied:

sq6wmgv2zcsrix6t.onion

If you go into this page using an anonymous browser named "Tor" you will get this



Those who applied early enough or followed the 'Numbers dot TK' hint were greeted with this email:



And from there, the trail goes cold. Nobody knows what happened after this, nor will we ever, as this was in 2012. About a month later with know word from the organization, they post this.

[ Register or Signin to view external links. ]

And after about 12 months, everyone kind of forgot about it.

All until 2013.


[ Register or Signin to view external links. ]


When processed with our old friend Outguess, this message comes up.



After a bit of debate, the text that was used to encrypt the book cipher was discovered.

The book that was used to hide the message was Liber AL vel Legis by Alester Crowley. The first line I:1:6 points toward the 6th character of the first line in the first chapter, an 'h' in this case. It was assumed that spaces weren't counted. Punctuation, however, influenced the character chosen for the plaintext. During decrypting, they found that dashes were vital to the process, so they kept them in the plaintext. Using these rules, they encrypted the book cipher and came up with the decrypted message.



This directed to a file of 130 MB. the file was analysed and a quick check for magic bytes (header bytes) revealed, that the offered file was an .iso image.
The image file was downloaded by multiple solvers and either burned to disc to run on a computer or opened in a virtual drive. Looking into its contents, they find three directories, "data", "boot" and "audio".

[ Register or Signin to view external links. ]

When booting from the image, a boot sequence appeared, printing a sequence of numbers to the screen. Investigating the sequence revealed, that the live image prints out all prime numbers up to 3301. There were temporary two-second pauses at 1033 and 3301, where it stops at the latter and moves to the second stage. The next, and last stage of the procedure is a screen that reads:



The folder "audio" contained an audio recording. The title of the recording was "761.mp3"
The ID3 tags show us that the title of the file is "The Instar Emergence" and the artist "3301". The used instrument is a guitar, with distorting effects on it. On the track, a reversed guitar is played and amplified throughout. The song has been deconstructed and checked for hidden reversed messages, but as of yet has turned up nothing out of the ordinary. Some people claimed the key of the recording to be G#.

A hexdump of the mp3 file revealed the following message:



It has also been pointed out that the song is 2:47 long, or 167 seconds, which is prime. It is also a reversal of the name of the file: 761.mp3, and 761 is also prime.

It was later found to be the reference on the boot CD to @1231507051321 is actually a twitter account, that posted messages at 5 minute intervals.
Each tweet consisted of an offset, and 65 bytes of hex code. This stumped decoders for hours.

But finally, a user depunked it and came up with this image.
[ Register or Signin to view external links. ]

It was soon discovered that this image, like the very first one, contained a hidden message, once again masked via OutGuess.. As in every message from Cicada, the content was followed by a PGP signature, which proved the authenticity of the message

The message, it turned out, contained a mixture of tabs and spaces. The solvers converted this to binary, then again to ASCII, then they found the next message:



The website can only be accessed through Tor. When you go to the website, you are greeted with this.

(Please note that is supposed to resemble a cicada, however the TTG forums distorted it.)

And yes, web browser were indeed useless here.
You would have to telnet into the website through the tor network. Some solvers did so, and they found that the website included an interactive shell. They could type in any number to have it factorized, 'count' to have it count up prime numbers, 'quit' to quit, and 'hello' to pump out an interesting message:


When translated into ASCII, it translates to this


When going to the website, you are greeted with this:

Rumaging through the source code for the html, they found the following:


Then soon after, shut down.

Once it reopened, it gave this message


This hint told the solvers that they needed to ping the website's IP address and listen to the reply. Each ping reply was laced with data bytes, which could be combined to make the following:



The third Onion page told users to "Standby for coordinates," And like 2012, the coordinates posted lead to a poster, which would look something like this.
[ Register or Signin to view external links. ]

Calling the phone number gave an automated speech asking for a code to be typed into the dialer. Solvers soon realised that they had to convert the access code given in the poster to it's gematrified format and type that in.

Once 5 of the phone numbers were decrypted (Each was different depending on location, people had to post them online so they could continue) the following message came about

p7amjopgric7dfdi.onion

The fifth website.

When the solvers visited the onion address they were greeted with this:



And while this is great, the trail once again goes cold. There are theories and "leaked" emails but nobody can know for sure what happened next. We can only assume this secret organization found who they wanted.

One theory that might be important to point out is what the point of cicada 3301 actually is. Based upon the "leaked" emails, they are an organization who think of themselves as a "think tank" and consist of political and military and scientifically figures. Keep in mind it is only a theory based upon leaked emails and documents.

But it isn't over yet, because on January 4th of 2014, they will be back.

January 4th, 2014

Cicada 3301 returns.

Update number one, 2:30 AM EST

We've seen some fake 3301 posts, so far we don't have an official 3301 post. I'm going to sign off for the night, I will wake up around 12:30 PM EST, and keep you guys posted.

11:30 AM EST

Still no sign of cicada, I will have an update by about 3:00 PM

January 6th
Found a confirmed cicada 3301 image!
[ Register or Signin to view external links. ]
It was posted by the cicada 3301 twitter we found in one of the 2012/2013 challenges. Scroll up for more info about that.
Here is the twitter: [ Register or Signin to view external links. ]

Also, one of the users found out the message in the image (not sure how yet) and here is the message:

EDIT:
Right now, as the facts come in, it is hard to seperate and figure out what some of them mean. I will have a well though out update by the end of tommorow.

(Please note some information may have been overlooked as I made this post, so I encourage all those interested to do more research.)