No

A cyber attack is a cyber operation, whether offensive or defensive, that is reasonably expected to cause injury or death to persons or damage or destruction to objects.

Michael Schmitt et al; Tallinn Manual 1.0, pp 92
  • Cyber Operation?
  • Expected to cause death or injury to people or objects?
MSS-linked Espionage Operations Targeting Defense Industrial Base Companies Using PulseSecure, F5 and Citrix Vulnerabilities does not match this definition. Here's a list of actual cyberattacks and and why this matters.

What happened?

Two state-backed hacking groups—one of which works on behalf of the Chinese government—exploited vulnerabilities in a VPN service to target organizations across the U.S. and Europe with a particular focus on U.S. defense contractors.