This article seems a bit confused about how the worm is spread: It is a simple bruit force password attack, targeted at mipsel Linux-based routers.

The post at DroneBL (linked to by the article) seems to be a better read:

http://www.dronebl.org/blog/8