Traffic can be intercepted and modified anywhere along its path to the endpoint or you can be tricked into sending data to an attacker who can then forward it for a MITM attack.
Everyone is vulnerable unless they verify the identity of the endpoint and validate the integrity of the data. In other words, use TLS.
Any of the upstream ISPs of your current network are in a position to modify your traffic. I hope you know your 3G, airport, and coffee shop providers well.
Any proxies you connect to can and do MITM you. Workplaces, "private" VPNs, and some countries' governments all do this.
Anyone on your network or anywhere upstream can poison ARP caches to redirect traffic through them.
Rogue networks can try to hijack traffic with malicious BGP announcements. Providers that don't protect themselves can end up routing traffic through a person in the middle.
Anyone can poison DNS on your resolver or any of the resolvers that your resolver may use or on insecure authoritative DNS servers so that a domain name you type in is resolved to a malicious IP address. The traffic is then sent (correctly) to the attacker.
Anyone that can compromise your computer can MITM you in a variety of ways depending on the OS. For example, by modifying the hosts file so that domain names are resolved to a malicious IP or by compromising firmware.
It is a prevalent attack in internet communication; or in any relayed information. The possibilities are endless. Verify endpoints. Encrypt data.