Supply Chain Integrity Concerns Rise Over Passwork Europe’s Technical Linkages to Russian State-Certified Software

Passwork Europe, a Spanish-based credential management provider utilized by various European public sector entities, academic institutions, and private enterprises, has come under intense scrutiny following an investigation by the OCCRP. The probe has identified significant technical and historical overlaps between the European entity and a Russian counterpart that maintains certifications from Russian state intelligence and regulatory agencies.

Technical analysis suggests that Passwork Europe S.L. and Russia’s Passwork LLC are not entirely decoupled products. Evidence points toward a common codebase origin, highly synchronized release cycles, mirrored documentation, and nearly identical deployment scripts. While there is currently no forensic evidence of malicious logic, intentional backdoors, or active data exfiltration, the discovery of such tight software coupling—combined with opaque corporate restructuring—raises fundamental questions regarding supply chain security for organizations managing high-value secrets.

The Technical Architecture of the Software Linkage

Passwork Europe markets itself as a sovereign solution, emphasizing its “Made in EU 2017” heritage and its support for self-hosted, private-server deployments. Alexander Muntyan, the company’s CEO and sole shareholder, has maintained that there is no operational or administrative crossover between the Spanish and Russian entities. He has specifically noted that the platform utilizes a zero-knowledge architecture, ensuring that encryption/decryption processes occur exclusively within the client’s local infrastructure, thereby preventing Passwork Europe from accessing vault contents.

However, the historical lineage of the software complicates this narrative. Investigative findings show the product originated in Arkhangelsk, Russia, where co-founders Ilya Garakh and Andrey Pyankov registered both the Russian (Passwork.ru) and the European-facing (Passwork.pro) domains as early as 2014. Following the liquidation of a Finnish entity (Passwork Oy), the intellectual property appears to have transitioned through a UAE-based firm, Passwork FZ-LLC, before Muntyan acquired the rights in 2024. According to Muntyan, this transition includes a knowledge-transfer period from the UAE entity that is expected to persist until August 2026.

The Risk of “Shallow” Software Separation

The most pressing concern for security architects lies in the update pipeline. Researchers observed that the Russian and European versions frequently release updates on near-identical timelines with virtually identical version numbering. For example, version 7.67.67.6 was released on the Russian platform and appeared on the European platform just 24 hours later.

Security researcher Lukasz Olejnik described the separation between the two products as “technically shallow,” noting that the installer scripts contain hundreds of lines of substantially identical code. This technical overlap is critical because the Russian Passwork LLC is certified by the Federal Service for Technical and Export Control (FSTEC) and the Federal Security Service (FSB). FSTEC certification requires providing authorities with deep access to software architecture, cryptographic implementations, and access control mechanisms to ensure there are no “undeclared capabilities.”

Supply Chain Implications and Due Diligence

Cybersecurity experts warn that if the codebases remain synchronized, any scrutiny or modifications required for Russian compliance could inadvertently impact the European variant. Bart van den Berg of the Clingendael Institute noted that synchronized codebases can expose both products to the same underlying vulnerabilities. Furthermore, German researcher Donald Ortmann highlighted that the software update mechanism remains a high-value vector for supply chain attacks—reminiscent of the SolarWinds compromise—where a trusted update carries a malicious payload.

For enterprise security teams and government agencies, this situation emphasizes that encryption strength is only one component of trust. A holistic security assessment must also include:

• Software Bill of Materials (SBOM) validation: Understanding every component within the build.
• Reproducible Builds: Ensuring the distributed binary matches the audited source code.
• Cryptographic Signing: Verifying the integrity of the update pipeline and signing keys.
• Transparency of Ownership: Maintaining clarity on the development lifecycle and third-party access.

While Passwork Europe maintains that its zero-knowledge model and client-controlled hosting mitigate the risk of data exposure, the investigation serves as a critical reminder: in the realm of credential management, transparency across the entire software supply chain is the only foundation for true security.