Sergey Jarets, who was behind the Andromeda botnet (also called Gamarue) that used Windows machines, was arrested after an effort by law enforcement in many countries, and also Microsoft.
The Andromeda botnet had 464 separate botnets that spread malware from more than 80 families for the last six years.
Microsoft said that its analysis of more than 44,000 malware samples had indicated that 1214 domains were used by the botnet which utilised command and control centres around the world.
Sergey Jarets' workstation at the time of his arrest.
"Ar3s is the mastermind behind the Andromeda Trojan and a longstanding administrator of the Damage Lab hacking forum, the company's researchers Andrei Barysevich and Alexandr Solad wrote.
"With a high degree of confidence, we assess that the arrested person is likely Jarets Sergey Grigorevich, although the name was not revealed by the Belarusian authorities."
Barysevich and Solad said that undercover FBI agents had ascertained the connection between Jarets and the Andromeda botnet by purchasing malware from him.
Jarets had been a respected member of the Russian-speaking underground community since at least 2004, they said, adding that he was known to have authored the Windows SMTP Bruter, an SMTP brute-forcing tool and also Swf-Inj Service which hijacked Web traffic by embedding iFrame malware into SWF (small web format) files.
The Belarusian hacker earned US$500 for each copy of Andromeda and US$10 for follow-up malware updates. The two Recorded Future researchers said the last time that Jarets had been noticed on the DaMaGeLaB forum, the community where messages were exchanged, was on 22 November, indicating that he may have been arrested on this day.
Barysevich and Solad said since following Jarets, "we learned that Ar3s has used the ICQ number '5777677' as one of his primary contact methods, which was connected to the Internet user 'Sergey Jaretz' (very similar to the Russian spelling “Арес” and conformable with Jaretz/Ярец), who was also registered on multiple white-hacker and tech-oriented forums since the mid-2000s.
"Once we had a possible name, we conducted subsequent contact analysis based on 'Sergey Jaretz' and this ICQ number. We discovered that the phone number of the Belarussian mobile carrier MTC (+375) 29-735-56-11 tied him with an individual in Rechica, Belarus named Sergey Jarets or Jaretz (in Russian: Сергей Григорьевич Ярец), a person working at OJSC 'Televid' Tele-Radio Company, broadcasting throughout Rechitsa area, Gomel Region, Belarus."
Photo: courtesy Belarussian Government