If your stepson had done this, while also being the one doing the bullying, I would've suggested that perhaps what he needs is for someone to lay off the punishing, and just focus on making him feel safe, and try to hone in on what's really going on that's causing this behavior, as punishment will often just launch a mutually detrimental power struggle.
Now that your stepson is the victim of the violence, I hold this to be vastly more true. Punishing him for this would be double punishment. You'll be putting him in a corner where there's no safe space - neither at school nor at home - and no safe behavior: he has only to choose between punishment from bullies or caregivers. I always caution against the use of punishment. I strongly urge against it here.
What's happened has happened. To punish for the sake of retribution on the side of the bully would just be inhumane and confusing. I'm going to assume you intend to employ punishment as a means of preventing similar behavior in the future. This means you can relieve yourself of any preconception of whether he deserves punishment. You should employ the most effective means to that end. I find that that's virtually never punishment.
What I would suggest: Talk to him. And more importantly: Listen to him. And do it without judging, interrupting or leading the way. Listen attentively and lovingly. "Because I could", to me, just says that he's not in a position to trust that you have his back on this. Reading your question, I'll say unsurprisingly so. And this is key: If he doesn't feel safe opening up to you, then you won't be a factor in how this eventually gets resolved, whether in the interim there is punishment being administered or not.
I don't know the age of the child; an appropriate response would vary with the level of cognition we can expect, but first of all acknowledge that this was an act of retribution for being wronged in the past. Validate his feeling of having been treated unfairly by this other person.
There'll come a point where you'll have the chance to say "Hey, I get that you were trying to get back at him for all the things he's done to you. I understand that this is all very unfair. But I still can't allow you to hurt anyone" - but you may have some work to do to ensure to him that you do listen, that you do take his view into account and cater to his needs, before he'll be open to take advice from you.
With hard work, hopefully you'll gain enough trust to be able to point out new ways of dealing with the bully. But as long as you're signalling that the way your stepson responds to being bullied is worse than the fact that he is being bullied, he'll rightly have no reason to trust that any such advice is given with his best interest in mind.