So in general (i.e. not specific to cyber), and even under the condition that Congress had declared war on Russia, it is illegal for civilians to engage in acts which harm the enemy. Only the military is allowed to attack.

read up on "unlawful combatant" and "irregular combatant"

Now if look more specifically at cyber, then there are laws such as

    The Computer Fraud and Abuse Act (CFAA)
    The Stored Communications Act (SCA)
    The Electronic Communications Privacy Act (ECPA)
    The Defend Trade Secrets Act (DTSA)

which define certain activities as criminal. If a person is on US soil and engaging in activities described in these laws, they may be in violation of criminal law. The location of the victim has little to do with it, it is location of the actor.

By analogy, if A does crime to B, it isn't B who prosecutes, it is the appropriate governmental organization.

Informative, but these seem hazy. What is soil in the cyber world? Or is it the passport "A" is carrying? As many have indicated, unlikely anyone in the west will prosecute?

There's a seemingly endless collection of crimes you could be charged with if you're hacking a foreign country from inside the US. From wire fraud to conspiracy and everything in-between. A federal charge of conspiracy carries a mandatory minimum of 5 years in jail.

even if you were to get a US attorney to prosecute you by turning yourself in, they'll highly likely give you probation even with "mandatory minimums"