Hackers went undetected in Citrix’s internal network for six months