Employees at the Illinois Office of the Treasurer working in a web server-heavy environment suddenly noticed that the servers had been taken over and the public-facing websites defaced. Drawing on the cyber defense tools they had at their disposal, they acted quickly to minimize the impact and return to normal operations.