Since I succeeded to repair the first attenuator, colleagues "rewarded" me by bringing another one. This time, the problem was electrical, it worked fine when it was new, but gradually became unreliable. When I got it, it didn't work at all over Ethernet, and when connected to PC via USB, it produced "device descriptor failed" error on Windows and "device descriptor read/64, error -32" on Linux.
I couldn't find anything wrong with usual visual and electrical checks, so I resorted to live comparison with a working unit. I probed the 6-wire serial link between MCU mainboard and RF board which controls PE43712 ICs, see attached image. In a good unit, SCLK ran at 1 MHz, but only at 100 kHz in the bad one. This led me to realize 8 MHz crystal oscillator in the bad unit isn't working. I was aware of it, but couldn't know if it's fault or feature. And I also didn't know that PIC32MX675F512H falls back to some internal oscillator when external one fails. Anyway, it turned out CLKI clock input (pin 39 on MCU) had low resistance to ground, about 12 ohms. It appeared and disappeared as I probed around it -- for example, it ran for about 2 hours after I re-melted crystal's solder joints, then it became shorted again. The crystal is in 4-pin 5x3.2 mm SMT package, with two pins connected to GND. Apparently, some internal structure slightly touched the crystal's case. That surprised me - I've encountered broken (open) or burnt (too high drive level) crystals before, but never a shorted one. For the time being, I replaced it with a small THT crystal I had on hand and the unit has been running for the last 3 days without any problems.
BTW, I tried reading firmware from the MCU, and to my amazement, it wasn't locked in (read-protected). I saved it as HEX files from both units, PM me if you need it. But I suspect it won't help you much, because about 100 bytes differ in the HEX files, even though both units have consecutive serial numbers. The differences are probably calibration data etc. which will be unique for each unit. The MCU uses standard Microchip 5-pin programming header, I marked its orientaton in the image. I also tried reading Winbond W25Q16JWNIQ Flash that's nearby, but it was completely blank on both units.