The unsophisticated technique gave the intruders access to two corporate drives for a “limited number of days,” Citrix's president says.