Presumably the attacker has some external command and control infrastructure they must use to get in and out of Citrix's networks, which is presumably what the FBI was tracking.