I assume they are referring to the CISA report today:

> The SolarWinds Orion supply chain compromise is not the only initial infection vector this APT actor leveraged.

https://us-cert.cisa.gov/ncas/alerts/aa20-352a

Yup, it was also mentioned in the article itself. I misread it originally. My bad, and thank you