An attacker with access to the inside network of a small company launches a successful STP manipulation attack. What will he do next?

As the spoofed root bridge, the attacker controls the Layer 2 topology and can configure a SPAN (Switched Port Analyzer) session to mirror traffic from other switch ports to their own, enabling full passive capture of all network traffic including credentials and sensitive data.

OSPF is a Layer 3 routing protocol entirely unrelated to STP exploitation; the attacker already controls the Layer 2 broadcast domain and has no reason to activate a routing protocol on the spoofed bridge.

The primary objective after gaining root bridge control is traffic interception for data theft, not denial of service; causing instability would alert defenders and disrupt the attacker's own eavesdropping.

Repeating the attack on all switches is unnecessary because spoofing the root bridge already causes all traffic in the broadcast domain to flow through the attacker-controlled device.