The article does not provide details, but does list a few steps to the exploit, the first being Linux users (as opposed to Linux servers) with poor antivirus.

For example, ZIP email attachments can contain extension-less files with the executable bit set. This would be one easy way of getting the initial payload bootstrapped.