Adversary Intelligence — 2026-07-19

European Password Manager Passwork Revealed as Russian Software Operating Under FSB License; French Companies Among Users

BLUFExposed European public-sector users will likely announce formal discontinuation or security review of Passwork by mid-October, given FSB certification granted Russian state laboratories access to the shared codebase.

An investigation by OCCRP, Le Monde, The Irish Times and NL Times found that Passwork, a Spain-based password manager marketed as an EU company with no Russian ties, was founded by Russian nationals Ilya Garakh and Andrey Pyankov 1234. The pair also own Russia-registered Passwork LLC, certified by the FSB and the Defense Ministry's FSTEC agency, whose clients include Gazprom and missile manufacturer Almaz 14. Reporters identified European users including Irish state bodies the CCPC, State Laboratory and Office of Public Works, and Dutch firms Novar and RTV Noord 34. Security researcher Lukasz Olejnik found 517 lines of installer code nearly identical between the Russian and European products 3. CEO Alexander Muntyan denied any operational links between the firms and attributed the similarities to a shared codebase origin 13.

Analysis
Irish and Dutch users are likely to formalize discontinuation or review of Passwork by October 17, with Novar's withdrawal in the Netherlands and open NCSC consultations at the CCPC, State Laboratory, and Office of Public Works setting the precedent. FSTEC certification required Russian state-accredited labs to review the shared codebase, leaving inherited vulnerabilities in the European product unruled out absent an independent audit of its zero-knowledge architecture. Sourcing is broad in outlet count but narrow in provenance, since Le Monde, OCCRP, The Irish Times, and NL Times all draw on the same consortium investigation rather than independent chains, yielding moderate confidence on the synchronized update cycles pending non-consortium or regulatory corroboration. Muntyan's explanation that identical timing reflects a shared historical codebase rather than live coordination remains unrefuted by any evidence of data-sharing or command channels. Formal discontinuation would force CCPC, State Laboratory, and OPW procurement officers to fund replacement credential infrastructure; continued use leaves government credential stores dependent on code vetted through FSB-linked certification.

4 sources