I assume they are referring to the CISA report today:

> The SolarWinds Orion supply chain compromise is not the only initial infection vector this APT actor leveraged.

https://us-cert.cisa.gov/ncas/alerts/aa20-352a