A security analyst reviewing packet captures notices that several client sessions with the company's web server negotiated TLS 1.0 despite both endpoints supporting TLS 1.3. The captures show an intermediary modifying the ClientHello to remove the stronger cipher suites before it reaches the server. Which type of attack does this most likely indicate?