In case you were wondering, the "baseband managment controller" is a wholly separate computer inside your computer, either layered on top of your existing Ethernet controller, or even with it's own separate Ethernet port.
supermicro.com/products/nfo/I…
supermicro.com/products/nfo/I…
It runs it's own operating system, often Linux. Putting your own flash chip, or even updating the correct flash chip with your own image, allows you to subvert the code and install your own malware/virus into the computer, regardless of the "real" operating system installed.
Thus, your BMC "virus" can then contact a C&C server on the Internet and download more interesting things to the server. This more complex code can first check the "real" operating system installed.
At that point, it's trivial to read/write memory of the "real" operating system to spread malware to that system and do evil things.
To read further on how such hacks would work, look for all the various DMA and SMBUS hacks over the years.
