A hacker in Ukraine who goes by the online alias “Profexer” is cooperating with the FBI in its investigation of Russian hacking efforts, The New York Times is reporting.

Profexer, whose real identity is unknown, wrote and sold malware on the dark web. The intelligence community publicly identified code he had written as a tool used in Russian state-sponsored hacking against networks associated with the U.S. election in addition to other government, political, and private entities in the United States.

The hacker’s activity on the web came to a halt shortly after the malware was identified.

The Times, citing Ukrainian police, reported Wednesday that the individual turned himself into the FBI earlier this year and became a witness for the bureau. FBI investigators are probing Russian interference efforts and whether there was coordination between associates of President Trump Donald John TrumpUS reimposes UN sanctions on Iran amid increasing tensions Jeff Flake: Republicans 'should hold the same position' on SCOTUS vacancy as 2016 Trump supporters chant 'Fill that seat' at North Carolina rally MORE’s campaign and Moscow. Special counsel Robert Mueller is heading the investigation.

ADVERTISEMENT

Ukrainian police did not provide details on the individual in question, including his name, but said he is living in Ukraine and has not been arrested. There is no evidence the individual worked for Russian intelligence.

However, in a Joint Analysis Report produced by the Department of Homeland Security and FBI and released publicly on Dec. 29, 2016, the government identified a sample of malware, called the PAS web shell, used by Russian civilian and military intelligence in state-sponsored hacks, some of which targeted election-related assets.

The particular malware was written by Profexer and made available for download on the dark web. He sold customized versions of the hacking tool to clients.

In January, the intelligence community publicly blamed Russia in the hacking of the Democratic National Committee.

This post has been updated.