An attacker with access to the inside network of a small company launches a successful STP manipulation attack. What will he do next?

After spoofing the root bridge using an STP manipulation attack, the attacker can force all network traffic to flow through their compromised machine. The next logical step is to configure a SPAN (Switched Port Analyzer) entry on the now-controlled root bridge, effectively port mirroring, to redirect a copy of this traffic to their computer for sniffing and analysis.

OSPF is a Layer 3 routing protocol, and activating it is not a direct or necessary follow-up to a Layer 2 STP manipulation attack aimed at traffic interception.

While a DoS can be a consequence, the primary objective of an STP manipulation is often man-in-the-middle for traffic interception, and simply repeating the action for DoS is not the next step for data exfiltration.

Spoofing the root bridge is sufficient to control traffic flow; repeating the attack against all other L2 switches is redundant and unnecessary for the goal of traffic redirection.