It is surprising that some entity in Pakistan is a customer of FinFisher. There are only two internet cables out of the country, both monitored by the state (which for example allows the continued blocking of YouTube. Therefore, if you have the IP address of someone it is trivial for anyone in the state/government to setup a system to access their unencrypted communication. Indeed the government has tried to buy such systems in the past (I can dig up the RFP if anyone asks).

This points to someone in the intelligence not wanting the other entities in the country to know exactly what they are doing.