The Sombra ARG was an alternate reality game (ARG) revolved around the character Sombra that took place outside of Overwatch itself. The game had been devised by Blizzard Entertainment as a way to build hype about the character.
May 24, 2016 (release)
- On Dorado, a newspaper can be seen whose headline reads ¿Quién es Sombra?, i.e. "Who is Sombra?".
- On the same map, there are monitors in the power plant that read "ACCESO NO AUTORIZADO: Protocolo Sombra" which translates to "UNAUTHORIZED ACCESS: Sombra Protocol".
- On a desk in the power plant, there is a folder marked 'Sombra' alongside folders for Jack Morrison and Soldier: 76.
- One of Reaper's voice lines while in Dorado is "Where’s Sombra when you need her?"
July 12, 2016
The first ARG element was hidden in the origins video for Ana. When paused at two separate spots in the video (1:16 and 2:11), two different strings of hexadecimal numbers can be found. When decoded, the extra letters that did not fit in the message revealed Sombra's name.
- First string translated
- ..la que tiene la información; tiene el poder...la que tiene la información; tiene el poder...la que tiene la información; tiene el poder...la que tiene la información; tiene el poder...somb
- Second string decoded
- ..la que tiene la información; tiene el poder...la que tiene la información; tiene el poder...la que tiene la información; tiene el poder...la que tiene la información; tiene el poder...ra
- "She who has the information, has the power..."
July 19, 2016
Ana was revealed in a developer update. At the end of the video, some static was shown accompanied by a beep right after the screen went its customary black. Within this static was a hidden QR code. Here is the result, once processed:
- ¿Estuvo eso facilito? Ahora que tengo su atención, déjenme se las pongo más difícil.
Translation: Was that easy? Now that I have your attention, let’s make things more difficult.
July 21, 2016
August 2, 2016
- Original code
Salted__ifK/Ei9^1Q*Qt+V= /عW'͠/ _V?qfF"=q[ z * Zu\5kLC
- Cracked code
U2FsdGVkX1+vupppZksvRf5pq5g5XjFRlipRkwB0K1Y96Qsv2L m+31cmzaAILwytX/z66ZVWEQM/ccf1g+9m5Ubu1+sit+A9cenD xxqklaxbm4cMeh2oKhqlHhdaBKOi6XX2XDWpa6+P5o9MQw==
- Center: D.Va (Temple of Anubis) 0:19 the letter “C” on a brick to the right of D.Va
- North: Torbjörn (Nepal) 0:20 upwards pointing arrow on the pointed wall ornament to the left of Torbjörn
- North East: Winston + Tracer (Volskaya Industries) 0:45 the letters “NE” on the blimp in the top left hand corner
- East: Mercy (Route 66) 0:17 the word “east” on the billboard in the center left
- South East: McCree (Hollywood) 0:23 a south-eastern dot on a compass to the far right of the screen
- South: Genji (Hanamura) 0:22 A downwards arrow on the peak of the roof behind Genji
- South West: Bastion (Hollywood) 0:32 the word “southwest” in the alcove to the center left
- West: Symmetra (Watchpoint: Gibraltar) 0:29 the word “west” on the wall to the left behind Symmetra
- North West: Tracer (King's Row) 0:47 on the pillar at the top of the screen behind Tracer's new player icon
Those investigating came to the conclusion that the answer rested in the skies above Dorado, where what appeared to be a coded "something" was found.
August 9, 2016
With detectives thrown off the right track (the Dorado sky "map" was just a glitch) while attempting to decipher the cardinal directions and letters, Blizzard provided the next clue in the form of a "data moshed" image of Dorado; essentially data moshing is a fancy way of saying a code is hidden in a picture.
- Extracted code
- Por que estan mirando al cielo? La respuesta no esta sobre sus cabezas, esta detras de ustedes. A veces, necesitan analizar sus logros previos.
"Why are you looking at the sky? The answer isn't over your heads, it's behind you. Sometimes, you need to analyze your previous achievements."
August 12, 2016
Proceeding to the achievements page of the official site, players noticed a new achievement named "?" with an inverted question mark for the icon, and "..." for the description. Upon inspecting the source code for the site, they received the message "Vientos, nada mal. No obstante, me aburro. Intentemos algo nuevo en la misma dirección." which translates to "Damn, not bad. But I'm getting bored. Let's try something new in the same direction.", plus another encrypted cypher. The key to the cypher rested in placing the aforementioned characters in order of the cardinal directions, i.e. "tracertorbjornwinstonsymmetradvamercybastiongenjimccree". That led to a url that contained a moshed image of Volskaya Industries which, when decoded, revealed an ASCII skull:
This has led some to believe that it references either the Day of the Dead - since Sombra may be Mexican - or the occurrence of BlizzCon 2016.
August 24, 2016
After a few seconds, or whenever users moved their mouse, the entire page glitched out and a string of code began streaming. Once decoded, another ASCII skull was revealed, but this was a little different than the previous. Using a Caesar-23 cipher (Sombra is, probably not by coincidence, the 23rd character to potentially be introduced), another phrase was offered:
LESPROMETIUNJUEGO ... CREOQUEUSTEDESLOSDETECTIVESDEJUEGOSLOLLAMARIANUNTRAILHEAD ?BLZGDAUSA-AMBAS-CALAVERAS.HTML
I promised you a game... I believe you Game Detectives would call it a Trail Head (?BLZGDA) use both skulls.
Hidden in the video is another clue that is hidden in the file description when downloaded, and a faint image of the Sombra skull will appear about 9 seconds into the video and glitch some of the text.
- Parecen estar muy interesados en estos "héroes". ¿Tal vez les interese conocer algunos detallitos que he averiguado sobre ellos?
"They seem to be very interested in these "heroes". Maybe interested to know some details that I found out about them?"
Additionally, the heartbeat of Janina Kowalska - presumed to be a pseudonym of Ana - was actually discovered to be Morse code. Once uncovered, it led those interested to a familiar Overwatch-related site: http://amomentincrime.com/ Except the site had been altered to the following:
...Estableciendo conexión... ...Protocolo Sombra v1.9 iniciado... ...Transmitiendo información a ómnicos activos... 2% ...Terminando conexión...
Sending an email to the amomentincrime site returns the following:
After more investigating, it seems the % shown at the amomentincrime site is slowly and steadily increasing, no doubt a "reverse countdown" to some reveal or event. The source code for the site also contains another message: "Bien hecho, ya tienen mi clave. Hackear este programa de televisión no tuvo chiste. Espérense a lo que sigue.", i.e. "Well done, you now have my key. Hacking that TV show was no fun. Wait for what’s next."
At the rate the percentage is increasing, Game Detectives figure the count"up" will end around October 16th.
More changes to the output of the page and source code have revealed:
- Increasing Protocol version number
- The following phrase:
- Parece que se están calentando un poco las cosas... tendré que pasar desapercibida mientras esto se finaliza., i.e. "It seems that things are are warming up a little... better go unnoticed while it completes."
September 22, 2016
A new PTR is released. The flashing message on the monitors in Dorado is changed to "ACCESO NO AUTORIZADO: Protocolo Sombra V2.3". The same flashing message is also on a monitor in Volskaya Industries. The patch finally went live on October 11.
October 18, 2016
amomentincrime.com reaches 100% completion. The website now says the following:
"Transmision finalizada - finalizando carga
Carga finalizada. Unidad Bastion E-54 comprometida"
Translated: "Finished transmission - ending load
Charging complete. Bastion Unit E-54 compromised"
This message could possibly lead to something happening to Bastion in the future.
October 19, 2016
A new patch was added into the game. When playing on Dorado as Bastion, it started to beep ominously when looking at the flashing monitors. Translating these beeps in Morse code led to a new URL titled lumerico.mx.
- Calling the phone number listed on the site led to another code which, when finally translated, read TAKECONTROL.
- Appending /takecontrol to the end of the site led to a page full of code.
- The following was decoded:
I'm congratulating you for getting in here. I only wanted to know if you were ready or not. (Hey, it's really difficult to get good help lately... you should see some of the clowns I'm working with). For now, let's continue with the true challenge: taking down Lumerico Corp president Guillermo Portero. Why? Because he's a greedy and corrupt man, and an abominable thief. His plan of bringing in line the most powerful and biggest ziggurat the 1st of november is nothing more than a deceit, an elaborate plan by his gang to become even more influential in the people of Mexico and get more money. And who's gonna pay for that? Common people, the ones that are always forgotten.
I've started upgrading my protocols so that they are used to take down the Lumerico Corp infraestructure and Los Muertos are also trying to go against the corruption. Meanwhile, search the Lumerico Corp site for info we can use against the bastard, or better, get his username and password so that hundreds "not so favorable" facts about the president start popping up.
I was able to get the username and pass of a Lumerico Corp employee, start here:
- Accessing the login portion of the site with the above credentials led to a slew of emails (Game Detectives listing here).
- Further investigation led to the following:
- A Presidential Bypass page, appearing to be nonfunctional
- A line in the page's source code led to a data dump that eventually resulted in the president's user name and password
- This enabled users to access the president's emails
While accessing these files, an email from Sombra was received:
(Translated) I see you have been able to infiltrate in your mail. Do not worry, he can not see this email, I've hidden from view if you connect from one of the known IP addresses. I need a little more time to set the next group of protocols. Stay tuned early next week. I'll take a few dirty rags in their emails to be filtered to the public "accidentally". We'll see how they react to the media.
October 25, 2016
Omnics.txt now reads:
- Allow: Tzolk'in
- Allow:Imix ChikchanManik Imix ChikchanImixChikchanImix Manik Chikchan Imix Kimi Chikchan Chikchan Kimi ChikchanImixChikchanImix ChikchanKimi
Tzolk'in was realized to be the name of a Mayan calendar, and when the long string of seemingly random names were substituted as days in the calendar. Those digits were then turned into pictograms - a string of Morse code - and decoded to EXECUTEATTACK. Plugged into LumériCo's site revealed another message:
Ha llegado el momento. Esos correos expuestos la verdad sobre Portero, iniciado la revuelta, y hemos convencido a la gente de México a apoyar nuestra causa. Ahora es el momento para el golpe. Convertiremos su preciada inauguración el 1 de noviembre en un gran movimiento en su contra. Necesito que hagan una cosa:
Consigan acceso al correo del jefa de seguridad y busquen alguna forma de ayudarme en el ataque. Es posible que lo vean contactando a Portero pronto. He cambiado su contraseña a: d0r*NuLw9
The moment has come. These emails exposed the truth about Portero, initiated the revolt, and have convinced people of Mexico to support our cause. Now is the time to strike. Convert his precious inauguration on November 1 to a large movement against it. I need you to do one thing:
Get access to the email security chief and seek some form of help in the attack. You may see her contacting Portero soon. I've changed her password: d0r*NuLw9
This gave access to an admin panel on the company's site that remained nonfunctional until November 1st.
October 27, 2016
Two new emails between María Jiménez and Alicia Calvo involving leaks are added to lumerico.mx. Noticas has also received an update:
CONSULTING SERVICE OUTAGE
We have received a number of reports of brief interruptions in service. Our technicians are investigating these incidents.
October 28, 2016
A new article titled LumériCo Revelations: CEO Guillermo Portero Under Fire is added to playoverwatch.com.
November 1, 2016
- From Game Detectives
On November 1st, the terminal became functional, and users could type
help to access a list of commands, one of which is
override. The answers to the three security questions are taken from an Overwatch movie, Some Like it Bot, and two references in the emails of MJimenez. Answering correctly revealed the following new commands:
ls Lists files by path
cat Read file by path
exec Execute a file
Combining these commands with some of the hidden file names and paths revealed that the unsolved "Tracer key" was meant to be used; once input, detectives were sent to a page similar to the amomentincrime site, where they were added to a counter.
When the counter met or surpassed 100, Sombra then appeared to hack LumériCo's site. A message was left in the source code:
Buen trabajo, amigos. No lo hubiera logrado sin su ayuda. En fin, me consiguieron los recursos que necesitaba para mi siguiente golpe – les encantará.
Esperen noticias de mí en los próximos días...
Les voy a mandar algo para agradecerles… Ojalá lo puedan aprovechar.
Good job, folks. I would not have done it without your help. Anyway, I got the resources needed for my next hit - you'll love it.
Expect to hear from me in the coming days...
I'm going to send something to thank you ... Hopefully you can use it.
MISDIRECTION was also in the source code. When plugging it into the company's url, it led to a message insinuating Volskaya Industries was the target of Sombra's next attack. Heading to that company's site reveals a broken main page.
November 3, 2016
The article Lumerico CEO Steps Down is released on playoverwatch.com.
November 4, 2016
Sombra is released in the Public Test Region on November 7th and finally goes live on November 15th. The LumériCo website has also disappeared, and is now replaced with broken playoverwatch.com links instead.
- LumeriCo home page
- About LumeriCo
- LumeriCo news
- LumeriCo login page
- A Moment in Crime site
- Overwatch forums clue
- Ana picture clue
- EXECUTEATTACK site
- Volskaya Industries home page
- ↑ Game Detectives wiki, Sombra ARG page
- ↑ Kotaku - Overwatch Fans Keep Finding Clues About A New Unreleased Character
- ↑ Kotaku - Overwatch Fans Find New Clues About The Mysterious Hero Sombra
- ↑ Polygon - Overwatch fans are trying to crack the latest mystery about Sombra
- ↑ PCGamesN - Overwatch compilation
- ↑ Reddit - Secret Directions in the Summer Games Update Video
- ↑ PCGamesN - Overwatch compilation
- ↑ Kotaku - Overwatch Fans' Sombra Investigation Reaps A Skull Code
- ↑ Gamerant - Overwatch Forums Glitch Out, Reveals Hidden Message From Sombra
- ↑ Gamerrant - New Website Counts Down To Next Clue For Overwatch’s Sombra
- ↑ Game Detectives wiki, Sombra ARG page
- ↑ Forbes: Overwatch's Agonizing Sombra Hunt Restarts With New Clues After Two Months Of Waiting
- ↑ Game Detectives: Sombra ARG, Presidential Login
- ↑ Game Detectives: Accessing the terminal
- ↑ https://twitter.com/PlayOverwatch/status/794627382577545220?s=09