Researchers have linked recent TeamTNT botnet activity to extraction and stealing of Docker and AWS credentials. Previously, it would mine cryptocurrency only on misconfigured container platforms.