A nice OSINT challenge, needing only Google searching.

The image shows a building with an inscription reading:
```
JUNCT...
= at =
NORTH S...
```

Googling the phrase "junction at north", we find "[Junction at North Seven](https://www.google.com/maps/uv?pb=!1s0x89e81d7a1c0bdeb1%3A0xded29cfc6b82adfe!3m1!7e115!4s%2Fmaps%2Fplace%2F%2522junction%2Bat%2Bnorth%2522%2F%4041.1482194%2C-73.427856%2C3a%2C75y%2C263.37h%2C90t%2Fdata%3D*213m4*211e1*213m2*211sVnPRmeFjyQHy_04QjVsp5Q*212e0*214m2*213m1*211s0x89e81d7a1c0bdeb1%3A0xded29cfc6b82adfe%3Fsa%3DX!5s%22junction%20at%20north%22%20-%20Google%20Search!15sCgIgAQ&imagekey=!1e2!2sVnPRmeFjyQHy_04QjVsp5Q&hl=en&sa=X&ved=2ahUKEwinyrvb_onyAhWXFMAKHWd9BqMQpx8wE3oECD0QCA)" located at 87 Glover Ave, Norwalk, CT 06850, United States.

Googling the words norwalk ransomware attack, we find a [news report](https://www.thehour.com/business/article/Hackers-hit-Norwalk-corporation-with-15093265.php) about a ransomware attack on EMCOR (based in Norwalk, CT).

Googling the phrase "The EMCOR ransomware incident", we find this Fortune 500 company was [hit](https://zephyrnet.com/ryuk-ransomware-hits-fortune-500-company-emcor/?__cf_chl_managed_tk__=pmd_c926f1732b0528763d86cbbfdddfcd1d8d368ef8-1627621952-0-gqNtZGzNAuKjcnBszQ_O) with the "Ryuk" ransomware.

Googling for images with the words "EMCOR" "Readme" "Ryuk", we get to a [report](https://sensorstechforum.com/remove-ryuk-ransomware-ryk-extension/) discussing some variants of the Ryuk ransom note, and specifying the contact mail address used in this attack.

The flag is SBCTF{[email protected]}