The suspect "is ​recognized ​as ​a ​leading ​expert ​in ​malware ​development ​and ​reverse engineering, ​network ​security, ​and ​antivirus ​technology," researchers wrote.

First launched in 2011, Andromeda was detected on an average of one million machines every month in the last six months.