The thief who changes the lock on your home while you're out. Then leaves you a note on the door.
A file is simply something you keep on the computer - a wedding photo, an invoice, a spreadsheet of clients. A cipher is a formula that scrambles its contents letter by letter, by a rule known only to the attacker. Without that rule, the file stays forever unreadable mush, even to you, its owner.
Imagine coming home to find the lock on your front door changed. While you were out, someone got in, fitted a new lock, and stuck a note on the outside: want access back to your own home, pay up. That's exactly what ransomware is - except the door is your computer, and the rooms inside are your photos, your documents, all your work.
The scheme is this widespread because it works without fail. Victims pay because the files really do vanish for them the moment of the attack. This isn't a threat in the air. It's a fact. And since the money moves through crypto, the trail to the attacker disappears.
The real defense isn't a sturdier lock on the door, but a spare key kept somewhere else, one the thief can't reach. In practice that's a copy of your files kept somewhere not permanently connected to the computer - an external drive, unplugged after every copy, or a cloud service the cipher physically never sees. If the copy sits connected to the network the whole time, it will get locked too.
Here's what people miss
I don't trust an attacker who has already proven he'll walk into your home without permission. Paying doesn't buy back trust - it funds his next round, at your place or the next person's. That's why I don't treat the backup as a technical detail buried in the settings somewhere. To me it's the one door that stays in my own hands, whatever he does with the rest.
When I build a system, my first question isn't how to stop the attacker - sooner or later he'll try. The question is: if he gets in, what stays untouched? The answer is always the same - the copy he's never seen, because it wasn't there when he came.