Confluence not stopping when killing its process

Peter Seger

Confluence has recently starting running at a pegged 100% CPU utilization (with no traffic) even though it usually hovers around 20-40% even with heavy traffic. I went to stop Confluence to investigate, but can't.

When I try to stop Confluence gracefully, it fails with 

PID file found but either no matching process was found or the current user does not have permission to stop the process. Stop aborted.

When I try to just for stop it by killing its process using `kill -9 PID`, it kills it but the process just restarts with a different PID seconds later. I don't have Conflunece auto re-start on or setup, so it should just kill it. Why is the process being recreated?!

Thank you!

Daniel Eads

Hi Peter,

What version of Confluence do you have installed currently?

The symptoms you described match an active exploit that attacks the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). We've seen attackers infect servers with malware that tries to mine bitcoin. The malware runs under the confluence system user account, consumes all the CPU, and relaunches itself every few minutes if you kill the process.

If you're on a vulnerable version, the first step in fixing this is upgrading Confluence. The latest releases are:

• 6.6.13 (6.6 is an Enterprise release)
• 6.12.4
• 6.13.4 (6.13 is an Enterprise release)
• 6.14.3
• 6.15.2

Secondly, the LSD malware cleanup tool will be useful for removing the Kerberods malware. I would recommend executing cleanup after upgrading Confluence to a patched version so there's no possibility of re-infection while you work on the upgrade.

Please let me know if you have more questions!
Daniel | Atlassian Support