It depends on the target of the cyberattack. Depending on who, what and when it'll be somewhere between a criminal action, a terrorist attack and a military action.

If you take down a power grid, that's pretty much a terrorist attack. The victims are likely heavily weighted to be civilians. Same for opening a dam to flood downstream.

But take the military radar installations the Iranians have bombed on military bases around the region since the US and Israel started this war. What if the Iranians had cyberattacked those same installations? I'd call that a military action. I'd even consider it less of an escalation than, say, blowing up a consulate in Damascus.