> ...but not a single time is it questioned who they planted it for...
The article and some accompanying reporting on Bloomberg audio/video segments says the attack seems targeted relatively specifically towards nearly 30 organizations (only US-based organizations were mentioned as targets, unknown if the list included organizations based in other nations). One known vector was through four subcontractors in China that built the boards for Supermicro's main Shanghai factory, specifically by bribing and/or coercing managers of those subcontractors' factories to go along with accepting the chip shipments and to make changes to the plant floor from the design to perform the chip insertions.
Designing and building a chip like this and then mounting the logistical effort to performing the insertions costing some non-trivial funds, coupled with the known targets, (Amazon didn't seem specifically targeted, Elemental a company they acquired was, who notably has US national security clients), form the circumstantial allegation that a PLA spy unit was behind the attack. You are correct that this doesn't entirely rule out a false flag possibility, but until we get more details about this, we're operating in the dark.
A false flag is an interesting supposition, but how would the US benefit from successfully convincing the world of the false flag's cover story?
The US has a few things to gain from this story: Economically, because Chinese products are perceived as compromised. Politically: because the Chinese government is seen in the offense.
The US has something to loose too: Being perceived as dependent on Chinese manufacturing and potentially compromised down to military hardware. (The first everybody knows, the second would be devastating for trust.)
All in all it would be a weird angle for a false-flag attack.
The article and some accompanying reporting on Bloomberg audio/video segments says the attack seems targeted relatively specifically towards nearly 30 organizations (only US-based organizations were mentioned as targets, unknown if the list included organizations based in other nations). One known vector was through four subcontractors in China that built the boards for Supermicro's main Shanghai factory, specifically by bribing and/or coercing managers of those subcontractors' factories to go along with accepting the chip shipments and to make changes to the plant floor from the design to perform the chip insertions.
Designing and building a chip like this and then mounting the logistical effort to performing the insertions costing some non-trivial funds, coupled with the known targets, (Amazon didn't seem specifically targeted, Elemental a company they acquired was, who notably has US national security clients), form the circumstantial allegation that a PLA spy unit was behind the attack. You are correct that this doesn't entirely rule out a false flag possibility, but until we get more details about this, we're operating in the dark.
A false flag is an interesting supposition, but how would the US benefit from successfully convincing the world of the false flag's cover story?