Police came to the conclusion after inspecting the area where the train was parked at Long Binh Depot in Thu Duc City, and reviewing security footage.
They said Ilyevsky Sergey, 30, is the main suspect, and he was joined by another foreigner whose identity is yet to be determined.
Sergey is a graffiti artist and has entered Vietnam three times. He had left Vietnam for Singapore on May 3.
The investigation is ongoing as Thu Duc police look for the other suspect.
The vandalism was discovered by a worker on April 30 at the Long Binh Depot, where the 17 trains to be deployed on line No.1 are parked, marking the second time the city’s metro train has been sprayed with graffiti.
No culprit has been found for the first instance last June.
The 20-hectare depot will serve as the control center and train maintenance yard.
The metro line, after several delays, is now 95% complete and expected to be operational this year.
It will run 19.7 km from Ben Thanh Market in District 1 to Long Binh.