Legality things, depends on jurisdiction, which may or may not depend on:

* where were the authors of the code, * where the code is stored, * who is attacked, * where are their servers, * who is attacking, * where are they based, * where did they attack from, * ...

IANAL but it seems very complicated from law perspective (we, humanity, don't have a global law)

Edit2: making a bullet point list is hard