Negative SEO attack

So one of my clients wound up getting a huge surplus in links a few months ago. These links didn`t affect the rankings but suddenly a month later, 400 links dropped and two weeks later, so did their rankings. Does this seem like a negative SEO attack? I`m seeing tons of links in mandarin and I`m not sure if this is something their competition did. I`m planning on doing a huge disavow for these new links, but a lot of them have already dropped which I think triggered a penalty. Thoughts?