Users on a corporate LAN report intermittent connectivity, and a security analyst notices that the gateway's MAC address in several hosts' ARP caches keeps changing to an unexpected value. Traffic that should reach the internet appears to be routed through an unknown internal host first. Which type of attack is most likely occurring?