A security analyst at a hybrid enterprise notices that internal users connecting to a cloud-hosted HR portal are receiving certificate warnings intermittently. Investigation reveals an attacker on the corporate LAN has poisoned the ARP cache of several hosts, silently relaying and reading traffic between the users and the default gateway before forwarding it to the cloud. Which type of threat does this activity BEST represent?