The TeamTNT cybercrime organization has been expanding and upgrading their warehouse of malicious scripts and payloads to target Amazon Web Services (AWS). These newly modified programs are crafted meticulously to target AWS systems but can also be deployed on-site, in containers, or on various additional Linux instances. TeamTNT payloads are intended to deploy and exfiltrate credentials from compromised systems in addition to mining cryptocurrency, establishing persistence, and moving laterally within a network. Additionally, TeamTNT actors are modifying these scripts to lessen detection by lowering the CPU power draw from 100% to 70%, evading some security alerting rules for malicious activity. The capabilities of the scripts TeamTNT deploys shows the adaptability of threat organizations into modernized environments including AWS, Kubernetes, Docker, and many more. With the continuous advancement of threat actor capabilities, CTIX analysts urge security practitioners and IT departments to establish and modify security rules within network defenses to lessen the chance of system compromise from threat actors.