You can get the query string and define variables:
<set-variable variableName="myAtt" value="#[message.inboundProperties['http.query.string'] == 'att=1234' ? '?att1=4567' : '']"/>
<set-variable variableName="myUrl" value="#[message.inboundProperties['http.query.string'] == 'att=1234' ? 'localhost' : '${targetServer4}']" />
<http:outbound-endpoint address="http://#[myUrl]/somepath/#[myAtt]" exchange-pattern="request-response"/>