Ransomware attacks have increased in recent years and the impact on victims and society can be considerable. In order to develop effective measures against ransomware, it is important to understand how attacks are committed. However, most research on ransomware focuses on technical aspects or specific stages in the process. Less scientific research has been conducted on the entire process or the human involvement in attacks. Moreover, while crime scripts exist for other forms of cybercrime, a crime script for ransomware attacks is missing in the literature. The current study seeks to address this gap through a crime script analysis of ransomware attacks, using 44 court documents from Dutch and English-speaking countries and 10 expert interviews. The crime script analysis helps in understanding the actions taken in each stage of a ransomware attack and the behavior of and interaction between victims and offenders. It shows how the ransomware ecosystem has professionalized, with groups investing time, effort and money in the malware and infrastructure, outsourcing parts of the process and sometimes providing victims with customer service. Furthermore, it gives insight into facilitators, including the security risks that enable attackers in gaining access and cryptocurrency mixers or exchange services that facilitate money laundering. The findings have helped identify potential situational crime prevention measures, which are described in the discussion.