There is something instructive about a no-contact list.
When the government arrested Brett Rosen on January 21, 2026, and filed its motion for conditions of pretrial release two days later, it attached a document that tells you more about the structure of what he allegedly built than the indictment itself. The no-contact list names everyone the Rosens cannot communicate with — directly or indirectly — while their case is pending. Company officers. Investors. Traders. And, listed by name along with their operating entities, the media promoters the government says they used to run the promotional operation across six OTC stocks.
In other words, the government looked at the scheme, identified the human infrastructure surrounding it, and told the defendants: you can’t talk to any of these people.
Four days after the arrest, a StockTwits account called BASHERS_POST_BULLSHIT appeared.
Four days.
That number is worth holding onto, because everything that follows depends on it.
The federal indictment against Rosen describes his method in language that leaves little to interpretation. Find microcap companies with aged debt. Structure convertible notes at prices that look reasonable from a distance. Obtain discounted shares — in one case at 92% below market. Then get on social media and tout the stock. Tell investors you haven’t sold a share. Tell them you paid millions for your position and would never harm the price. Deny, publicly and by name, the very thing you are doing.
Between October 2021 and November 2022, according to the indictment, RB Capital sold approximately 450 million shares of Cyberlux for gross proceeds of approximately $11.5 million. In the same period, Rosen posted on X that he hadn’t sold a single share and “never received any shares — I paid millions of dollars for them.”
That is the playbook. Keep it in mind.
Now look at what BASHERS_POST_BULLSHIT does.
Three hundred and twenty posts across seventy-six active days. Promotional boilerplate copy-pasted across multiple boards. Critics identified as illegal stock manipulators. Readers directed to report those critics to the SEC at sec.gov/tcr. On at least fifteen separate occasions, the account names me by byline, calls me an illegal stock manipulator in violation of Section 10(b) of the Securities Exchange Act, and invites shareholders to file complaints and eventually sue me once I’m formally charged.
The specific statute it keeps invoking against me is the one Brett Rosen was arrested for violating.
There is a version of this where that is simply ironic. There is another version where it is the most honest thing the account has produced — an accidental self-portrait, pointing at the journalist covering the scheme while running the scheme’s promotional method on the scheme’s stocks.
Because here is the detail that turns this from ironic into structurally significant: the account doesn’t operate on $CYBL alone. It operates on $CYBL and $ILUS simultaneously. Those two specific securities. Out of all the tickers on the OTC markets, out of all the stocks an independent retail investor might plausibly hold, this account runs promotional operations across the precise combination that appears together in paragraph six of a federal indictment.
$ILUS is a niche OTC security — a company headquartered in New York with operations in London and Dubai, focused on public safety equipment and precious metals recycling, named in the Rosen indictment alongside Cyberlux as one of six stocks in the alleged manipulation scheme. The overlap is notable. A retail investor who happens to hold both is a coincidence. An account that appears within four days of the unsealing, runs the indictment’s described playbook, and targets the journalist covering the case is difficult to reconcile with that explanation.
It gets more specific.
The BASHERS_POST_BULLSHIT account was created January 25, 2026. The Sassybitch account — which I examined in March, and which I showed activated seventy-six minutes after I published an article following SOF Week — was created in September 2021. That same September, Cyberlux signed its financing agreement with RB Capital. That same September, the company launched the internal restructuring programme it called Operation Alpha. That same September, blocks of twenty million shares began moving to names that would keep appearing in the company’s filings for years afterward.
An account created in September 2021 and silent for nearly four years is consistent with infrastructure built before the problem appeared — which is when you build infrastructure, not after.
Sassybitch was not alone in that window. September 2021 produced a cluster of CYBL-focused accounts — different voices, different registers, different functions. Some ran promotional narrative. Some projected retail investor authenticity. Some provided factual positive framing. What they shared was a creation date, a stock, and a window that coincided precisely with the RB Capital deal and the launch of Operation Alpha. Sassybitch was the confrontational layer. The others were the environment it operated inside.
BASHERS isn’t the same account. But it occupies the same function. The difference is that it appeared not at the start of the operation, but four days after the government tried to shut the operation’s direct channels down.
The no-contact order is the mechanism worth examining here. The government imposed it because it identified the human network surrounding the scheme and wanted to protect potential witnesses and victims from contact during the prosecution. It covered known investors in all six scheme stocks. It covered company officers including Cyberlux CEO Mark Schmidt. It covered the media promoters by name. It was a map of the ecosystem, drawn by the people who had spent months investigating it, and entered into force on January 23rd.
What the order cannot do is reach actors it hasn’t named. It restricts the defendants’ communications with identified individuals. It cannot cover the full perimeter of a network it has only partially documented. Forty-eight hours after it was entered, an account appeared that operates on the scheme’s stocks, runs the scheme’s method, and targets the journalist who has been documenting the scheme’s structure since November 2024.
Whether that account was created by someone who received a direction through some channel the order doesn’t cover, or by someone acting on their own initiative to protect financial exposure, is a question the available record doesn’t resolve. What the record does establish is the gap, the timing, the stock selection, and the method. Those four facts, taken together, are not easily explained by a retail investor discovering two niche OTC stocks four days after a federal arrest and deciding the most urgent priority was to accuse the reporter covering the case of securities fraud.
The indictment charges the people at the centre of the scheme. It does not charge every element of the promotional ecosystem that surrounded them. What this means, practically, is that the method the indictment describes can continue to operate — through different vessels, at different accounts, with different usernames — as long as the underlying exposure exists and the identified parties maintain plausible distance.
The scheme doesn’t end when the indictment lands. The machine keeps running. The indictment just changes what it’s running on.
I should mention one other thing, because it completes the picture in a way nothing else does.
About a year ago, I was having a drink with a friend at a bar we both know well. A group came in. Introductions went around. I ended up talking for about fifteen minutes with a man who told me, with the ease of someone who has said this sentence many times, that he was a professional paid stock promoter. He knew Cyberlux. He knew Brett Rosen. I told him my interest in both. My friend stayed and talked with him for another half hour. Then we all went home.
When the government filed its no-contact motion and I read through the attached list, I recognised his name.
The indictment describes a network. The no-contact list documents it. The account that appeared four days later suggests it is still operational. And somewhere in a bar, about a year before any of this became public, a piece of that network introduced itself, told me what it did for a living, and asked what I was working on.
These things have a way of connecting.
Disclaimer
All articles and commentary regarding Cyberlux Corporation are based entirely on information drawn from publicly available sources, including court records, government documents, and financial disclosures filed with OTC Markets. The content presented here is intended solely for informational and analytical purposes and should not be interpreted as legal advice, financial advice, or investment guidance.
Any interpretations, opinions, or conclusions expressed reflect analysis of these publicly available materials. Determinations regarding legal matters ultimately rest with the courts and appropriate authorities.
Readers are encouraged to independently verify information and conduct their own research. If you believe any reporting contains an error and can provide verifiable documentation, we welcome the opportunity to review and promptly correct any inaccuracies.