The TeamTNT threat actor appears to be setting the stage for broader cloud worm attacks, researchers say.