Page History

...

Looking at running processes with atop, two jump out as suspicious: dblaunchs and khugepaged running as the Confluence user. A third process, kerberods  occasionally appeared too:

and a curl command:

Yes, Confluence has been hacked 

...