This, of course, depends on your architecture, but if the DHCP service is running on an internet facing server doing other things, and is multihomed, I can see what it may have just been left to ...

The attackers set up a rogue DHCP server that alters the routing tables so that all VPN traffic is sent straight to the local network or a malicious gateway, never entering the encrypted VPN tunnel.