(Reuters) - BlackRock Inc BLK.N, an investor in Cofense Inc, is in advanced talks to take over the U.S. cyber security firm, after a U.S. national security panel asked buyout firm Pamplona Capital Management LLP to sell its stake, people familiar with the matter said on Sunday.

FILE PHOTO: A sign for BlackRock Inc hangs above their building in New York U.S., July 16, 2018. REUTERS/Lucas Jackson/File Photo

The Committee on Foreign Investment in the United States (CFIUS), which scrutinizes deals by foreign acquirers for potential national security concerns, has not disclosed why it asked Pamplona to sell its 47% stake in Leesburg, Virginia-based Cofense, which helps protect email users from phishing attacks.

The development represents one of the rare, high-profile examples of CFIUS undoing a deal that had already been completed.

A major investor in Pamplona’s private equity funds is Russian billionaire Mikhail Fridman, who was included in an “oligarchs’ watchlist” by the U.S. Treasury Department that could have resulted in sanctions against him because of his potential ties to the Kremlin.

However, unlike other Russian oligarchs such as Oleg Deripaska and Viktor Vekselberg, Fridman has not been hit by U.S. sanctions.

“The process remains ongoing and we are working diligently towards a solution,” Pamplona said in a statement, declining to comment further.

Representatives for BlackRock, Cofense, Fridman and the U.S. Treasury, which chairs CFIUS, did not immediately respond to requests for comment.

Pamplona decided last October to launch an auction process to sell its stake after CFIUS approached it. Pamplona took the decision 10 months after acquiring Cofense with BlackRock, and other investors, including Adam Street Partners and Telstra Ventures, in a $400 million deal.

BlackRock, which owns a 30% stake in Cofense, is the front-runner to buy Pamplona’s stake in a deal that could be reached as early as this week, the sources said. However, it is still possible that another bidder prevails or that negotiations will fall through, the sources added, asking not to be identified because the negotiations are confidential.

A July 19 deadline agreed with CFIUS to reach a deal for Cofense has already lapsed. Complicating negotiations is the involvement of the U.S. government, which has formed a trustee with the company to oversee the sale, the sources said.

The protracted process is also weighing on price negotiations. Pamplona is negotiating with BlackRock a mechanism of deferred payments that will be based on the future financial performance of Cofense, which it hopes will eventually lead to a deal value higher than last year’s investment, the sources said.

It is also possible, however, that the deal ends up valuing Cofense, which was previously known as Phishme, lower than last year’s $400 million valuation, the sources added.

Pamplona and BlackRock did not seek CFIUS approval when they completed their deal for Cofense last year, because the review system is voluntary and the firms thought there would be no national security concerns raised, according to the sources.

The firms relied on Cofense’s management team, which also has an equity stake in the company, to run the business, the sources added.

CFIUS has made cyber security and the protection of personal data its top priority in recent months. The U.S. intelligence community’s 2019 Worldwide Threat Assessment report cited Russia’s efforts to interfere in the U.S. political system.

In another example this year of CFIUS seeking to untangle an acquisition, it asked Chinese gaming company Beijing Kunlun Tech Co Ltd earlier to sell Grindr LLC, the popular gay dating app it has owned since 2016. Grindr collects personal information submitted by its users, including a person’s location, messages, and in some cases even someone’s HIV status.

Last year, CFIUS launched a pilot program under which filings for review for certain types of investments in some U.S. technology companies it deems to be of critical importance are no longer optional.

ALFA GROUP TIES

Fridman and his partners control Alfa Group, which includes top Russian private bank Alfa Bank, its biggest food retailer X5 Retail Group and other assets.

Fridman, whose net worth is pegged by Forbes at $15.9 billion, is also a principal shareholder in LetterOne, which invests in energy, telecoms, technology and other areas.

Pamplona was founded in 2005 in London by Moscow-born British dealmaker Alexander Knaster, who had previously served as CEO of Alfa Bank from 1998 until 2004. Last year, Knaster passed on day-to-day management of Pamplona to co-managing partners Martin Schwab and William Pruellage.

Knaster remains chairman of Pamplona, which manages over $12 billion in assets across a number of funds.

BlackRock, the world’s largest asset manager, is best known as a provider of mutual funds, but has also invested in private equity since 1999. This year it has raised $2.75 billion for a long-term private capital fund that has a provisional fundraising target of $10 billion.

(The story corrects spelling of Fridman in paragraph seven)