It called “offensive security” in infosec circles.

Legality is hazy to poor, so most orgs wont admit to doing it, but this is far from the first group willing to huck a few rocks back.