EG black faxing their offices, catfishing governors and Duma members and judges to relieve them of their money, draining their bank accounts, causing general pandaemonium, etc, so as to be able to help Ukraine.
Presumably, many of the activities you describe ("draining their bank accounts") would come under the definition of fraud. Some countries are dragging their feet when it comes to the prosecution of computer fraud against victims abroad, but generally speaking, that is illegal. Others might come under various computer sabotage laws, while yet others (catfishing for emotional distress) may fall under stalking -- or be legal.
Your question seems to argue that the targets are "deserving victims" in some way, but most legal systems do not allow the perpetrator to make that decision.
One could also try to argue that cyberattacks are an act of war. International laws are still highly unsettled on that. If it was an act of war, it would not be for a private citizen to initiate it.