Such a response would generally be a crime; existing cybercrime legislation generally does not have any clauses permitting retaliation as "self defence", and al

Such a response would generally be a crime; existing cybercrime legislation generally does not have any clauses permitting retaliation as "self defence", and also very often you'd be DDoSing an innocent third party, another victim whose compromised device is abused to route traffic, and also affecting their neighbors on the same network.