After a quick ls -al, I found out that there was a .backup directory owned by leviathan1.

Again, a ls -al shows us an executable, that is owned by leviathan2 with the suid bit set.