Korean Research Institute for Construction Policy

The organisation is known by the alias Korean Research Institute for Construction Policy.
Its headquarters is located in South Korea.

On 25 January 2023, the Chinese-language hacktivist group Xiaoqiying launched a campaign against several South Korean research and academic institutions.
The Korean Research Institute for Construction Policy was among the entities targeted in this late‑January operation.
The attackers exfiltrated data, claiming to have taken 54 gigabytes of information from the compromised systems.
They also defaced the institute’s website, posting messages that indicated an invasion.
To carry out the breach, the group employed penetration‑testing tools and publicly available proof‑of‑concept exploits.
After obtaining the data, Xiaoqiying shared the stolen information on various cybercriminal forums.
The group claimed a partnership with the notorious collective Lapsus$ as part of its propaganda.
The motivation behind the attacks was described as patriotism toward China.

Following the initial campaign, the group expanded its operations to targets in Japan and Taiwan.
After their Telegram channels were shut down, Xiaoqiying maintained activity through a clearnet website.
Investigators found no direct links between the hacktivists and any government entity.
The attackers’ focus on non‑financial gain suggests that ideological drivers, rather than monetary motives, were primary.
We have no further publicly available details about the institute’s core functions, scale, or organisational structure from the supplied sources.