Anonymous: Chicago activist "T" Another Word for Traitor

Again i was searching PasteBin for some interesting pastes. This time i stumbled upon a PasteBin titled:  "T" Another Word for Traitor. This PasteBin was uploaded by Anonrchy and has been released on OCT 18TH, 2011. The PasteBin contains information on #REFREF, Anonymous, Sabu and the Operation Occupy projects.

The document targets Arturas  T Rosenbacher and it claims he should not be trusted. 

"T" Another Word for Traitor

  1. Arturas “T” Rosenbacher: Not to be trusted.
  4. The Chicago activist Arturas Rosenbacher known as “T”, @TOccupy, @USAanon, @Anon2T, @OccupyChicago is a publicly admitted snitch and scam artist. This letter attempts to address a number of the controversies and security concerns involving T. We are not the only people worried about “T,” World Net Daily ( clearly has known about the issues surrounding “T” for sometime. Their article and ours calls into question “T’s” seemingly trustworthy and jovial nature.
  6. Due to this, Anonymous warns you NOT TO TRUST “T!”
  9. “T” runs the OccupyChicago facebook account, the OccupyChicago twitter account, helps with the website, as well as controls all funds/donations for the OccupyChicago group. Because of this, all actions and organizations relying on him are compromised. This means all donations to the Chicago Occupation are in danger of never getting to those in the Occupation because "T" has access to the account.
  11. As mentioned earlier "T" uses many monikers  such as @OccupyChicago, @USAanon, @AnonSabu, @Anon2T, @AnonSabu, @theD3V, and is also an admin for Many of the twitter accounts have been since deleted, or have most content removed, although you can view the contents of some of these twitter accounts by searching for the name in google.
  13. "T" has publicly confirmed his affiliation with @AnonCMD and #RefRef on the October 16th Occupy Chicago JustinTV stream which can be seen at time 1:13:55 or visit the audio only version on Youtube, He has also admitted to many people in person and on the Internet to being the same person.
  15. #RefRef Controversy
  18. "T" has betrayed the trust of many people in Anonymous causing him to be nearly universally condemned and banished from many anonymous channels. @AnonCMD claimed to have invented a new DDoS tool known as #RefRef and for months he gained the trust of many anons, announcing that he was going to release this tool on September 17 (the start of OWS). This was a lie.
  20. “T” also collected donations from the Anonymous community for the release of #RefRef. When 9/17 came around, he admitted it was a hoax and completely fabricated all the claims made twitter and other websites.
  22. His website was “hacked” exposing @AnonCMD for what it was. Although in the truly cynical and pathological manner typical of “T” he later claimed to taking down his own website and writing the statement himself.
  24. It is said that @AnonCMD was collecting a lot of private information about anonymous members including names as well as private information about upcoming operations/hacks. Because of this, he was kicked out and ostracized from most anonymous communities, condemned as a “movement traitor” and “hoaxer” who betrayed the trust of many. (Google searches for “anoncmd” and “#refref” demonstrate this).
  26. The Department of Homeland Security released a global warning regarding the #RefRef tool prior to it’s release date and regarded it as a serious concern ( Why is “T” going around admitting to being the mastermind behind #RefRef while DHS is actively looking for him? AnonCMD admitted in early september that he was visited by the FBI where he says they seized his equipment and questioned him about refref and September 17th. Could it be that AnonCMD agreed to work with federal law enforcement? Details of his raid/visit/questioning should be explained in full detail.
  28. Bragging / Making False Claims
  31. “T” has also bragged on several profile websites that he is or was affiliated with LulzSec and WikiLeaks. Many LulzSec members (Sabu for example) has publicly outed “T” as a liar and hoaxer. In the past, @Anoncmd has allegedly attacked’s website with DDoS attacks because of “monetary disputes” between @Anoncmd and Julian Assange.
  33. This is assumed to be another fabrication created to cause big the “Anonymous Attacks WikiLeaks” headlines. It is universally known that Anonymous nearly universally supports WikiLeaks. We would never condone an attack on our brothers and sisters at WikiLeaks.
  35. In late August, “T” used one of his twitter accounts to promote a PasteBin ( advertised as “WikiLeaks D0X” which included the name “Arturas Rosenbacher” as the “executive director” of WikiLeaks. This was never corroborated ANYWHERE else on the Internet and clearly is another attempt at misdirection.
  37. He has told different stories to various members of the Occupation community either saying that he still works for Wikileaks, or that he was working for Wikileaks until financial issues came up between him and Assange. It is highly doubtful that an organization like WikiLeaks which has many established security protocols in place to reduce possibilities of breaches, as well as protect the anonymity of their volunteers, would trust a 19 year old kid with an untrustworthy history.
  39. It must be stressed and repeated that “T’s” claim that he and Anonymous attempted a DDoS attacks against WikiLeaks served to drive a false wedge between Anonymous and WikiLeaks. This was an action by a provocateur to create a false schism between allies. Can we not assume “T” will try and do this again to the Chicago Occupation movement? Has he not already done this with various inflammatory statements regarding the Police and Radicals?
  41. On October 18th, the twitter/facebook account for OccupyChicago was allegedly “hacked” and had posted links to the WSJ article about “T”. It is difficult to tell whether this actually happened or not, but T did remove “all other admins” from posting to it. “T” had previously “hacked” his own website (, which previously advertised #refref) taking down all content and putting up this message: "@AnonCMD was setting up a massive DoX of most anonops op’s and anonymous’ members. #RefRef Never Existed. We have taken him over, and he is done. He also used one password for all of his services. Expect a DoX soon, we now have his Twitter and Email.  - AnonSabu(not the real Sabu)"  When asked about this, he said that he “hacked” his own website and put up that message himself. Does this type of misdirection make any sense unless “T” was a provocateur?
  43. Other Issues
  46. “T” has frequently used the OccupyChicago twitter/facebook account for his own purposes/politics acting outside the general will of the group. One notable example is when “T”  posted a statement on the Facebook group condemning the October 10th planned civil disobedience as the work of “violent union members” that had “nothing to do with OccupyChicago”.
  48. This message not cleared by other Occupy Chicago members, and the vast amount of the protesters overwhelmingly supported the civil disobedience (we attended the protest in mass). This message had a (hopefully minor) effect of driving a wedge between union members and Occupy Chicago, as well as condemn tactics like civil disobedience as “violent” despite the movement’s general approval of CD.
  50. This was was later deleted after people brought it up. Furthermore, “T” was encouraging people on the OccupyChicago facebook page to “send pictures and information about the arrests” to “T”’s personal gmail address. The CD was planned in advance by many individuals and had the work of legal advisers and protest planners ahead of time, so why would “T” be the person folks should be sending info/pics to regarding the CD?
  52. Conclusion
  55. It is alarming that many of OccupyChicago’s tech infrastructure is relying on the work of an untrustworthy individual like “T”. At best, “T” is a socially awkward liar and hoaxer who has manipulated and betrayed the trust of many people, and is not being open/honest about his history with other OccupyChicago people.
  57. At worst, T is intentionally trying to disrupt OccupyChicago, and is possibly working for the Banks or Law Enforcement.
  59. Regardless, he should come clean and openly address each and every one of issues brought up here, and have his control of the OccupyChicago funds and the tech infrastructure removed and distributed more evenly to other volunteers in a transparent manner.
  61. If you feel like you need more background information on this complicated subject please consult the following: | | | | |  and
  63. “T” we are coming for you.
  64. We are Anonymous.
  65. We are Legion.
  66. We do not forgive.
  67. We do not forget.
  68. Expect us.



 Collected links from the PasteBin:









Published by:

CWZ's picture

Reza Rafati

I am the founder of and I focus on sharing and collecting relevant cyberconflict news., The goal of Cyberwarzone is to provide the world a portal with global cyberwar information. The effort in getting this cyberwarfare information is hard. But as the internet is growing we need to get an global cyberwar & cybercrime monitoring system., By the people and for the people. We will be gathering information about Cybercrime, Cyberwarfare and hacking. LinkedIn:

The Netherlands

My website