Presumably the attacker has some external command and control infrastructure they must use to get in and out of Citrix's networks, which is presumably what the

Presumably the attacker has some external command and control infrastructure they must use to get in and out of Citrix's networks, which is presumably what the FBI was tracking.