The article specifically says that the attack goes after the Baseboard Management Controller (BMC). In Supermicro equipment this takes the form of a separate SOC made by ASPEED that runs it's own operating system entirely separate from the main CPU but with access into the main system through various mechanisms. Facebook uses the same ASPEED chips in their open hardware projects.